Please unblock package pdns-recursor
[ Reason ]
I would like to update pdns-recursor 4.8.2 to 4.8.4, to:
- fix CVE-2023-26437, sole change in 4.8.4
- get the fixes for the resolving/validation logic from 4.8.3.
While this is a new upstream release, there are no new features, and
only bugfixes.
In previous Debian releases applying security fixes to pdns-recursor was
often problematic when the resolve/validation logic had to change. This
part of the code is long and complicated, only understood by DNS experts,
and also very relevant on the Internet and under flux of the living
Internet.
Security fixes have to change this code, and applying patches on top of
each other touching the same code parts often does not work without
importing all the changes.
We are certainly not in a better position to judge these code parts than
upstream is.
[ Impact ]
Security bug is fixed; applying future security patches will be easier.
[ Tests ]
Resolve/validation logic is tested by a build-time test suite.
I have manually tested it as well, but obviously I cannot reproduce the
security problem easily.
[ Risks ]
Open security bug in bookworm.
Applying future security patches will be harder or impossible.
[ Checklist ]
[x] all changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in testing
[ Other info ]
Another fix upstream included in 4.8.3 involves log levels of common log
messages, to spam journal less with "error" severity.
debdiff is produced using the following command to ignore generated
files and the publicsuffixlist, which our packages do not use by default
at runtime:
debdiff pdns-recursor_4.8.2-1.dsc pdns-recursor_4.8.4-1.dsc| filterdiff -x '*/pubsuffix.cc' -x '*/effective_tld_names.dat' -x '*/*.1' -x '*/configure'
This is a pre-approval request, I have not uploaded yet.
unblock pdns-recursor/4.8.4-1