Summary: | build of dns/bind95 port dies with link-time errors | ||||||
---|---|---|---|---|---|---|---|
Product: | Ports & Packages | Reporter: | Ronald F. Guilmette <rfg> | ||||
Component: | Individual Port(s) | Assignee: | Doug Barton <dougb> | ||||
Status: | Closed FIXED | ||||||
Severity: | Affects Only Me | ||||||
Priority: | Normal | ||||||
Version: | Latest | ||||||
Hardware: | Any | ||||||
OS: | Any | ||||||
Attachments: |
|
Description
Ronald F. Guilmette
2008-08-06 10:00:07 UTC
Responsible Changed From-To: freebsd-ports-bugs->dougb Over to maintainer (via the GNATS Auto Assign Tool) dougb 2009-01-08 08:18:45 UTC FreeBSD ports repository Modified files: dns/bind9 Makefile distinfo dns/bind94 Makefile distinfo dns/bind95 Makefile distinfo dns/bind96 Makefile distinfo Log: Update to the -P1 versions of the current BIND ports which contain the fix for the following vulnerability: https://www.isc.org/node/373 Description: Return values from OpenSSL library functions EVP_VerifyFinal() and DSA_do_verify() were not checked properly. Impact: It is theoretically possible to spoof answers returned from zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6). In short, if you're not using DNSSEC to verify signatures you have nothing to worry about. While I'm here, address the issues raised in the PR by adding a knob to disable building with OpenSSL altogether (which eliminates DNSSEC capability), and fix the configure arguments to better deal with the situation where the user has ssl bits in both the base and LOCALBASE. PR: ports/126297 Submitted by: Ronald F.Guilmette <rfg@tristatelogic.com> Revision Changes Path 1.86 +11 -8 ports/dns/bind9/Makefile 1.48 +6 -6 ports/dns/bind9/distinfo 1.91 +11 -8 ports/dns/bind94/Makefile 1.51 +6 -6 ports/dns/bind94/distinfo 1.93 +12 -8 ports/dns/bind95/Makefile 1.53 +6 -6 ports/dns/bind95/distinfo 1.95 +11 -8 ports/dns/bind96/Makefile 1.55 +6 -6 ports/dns/bind96/distinfo _______________________________________________ cvs-all@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/cvs-all To unsubscribe, send any mail to "cvs-all-unsubscribe@freebsd.org" State Changed From-To: open->feedback What I believe to be an appropriate fix has been committed. Please test again with 9.5.1-P1 and let me know if it works for you. Thanks for bringing this to my attention, Doug State Changed From-To: feedback->closed Feedback timeout |