[PATCH] [release-branch.go1.15] net: verify results from Lookup* are valid domain...
authorRoland Shoemaker <roland@golang.org>
Thu, 27 May 2021 17:40:06 +0000 (10:40 -0700)
committerShengjing Zhu <zhsj@debian.org>
Sat, 5 Jun 2021 11:36:34 +0000 (12:36 +0100)
commit0a3998d0507e03a31ed48852d90ad1e00015e1e8
tree752a75c2f2076db01c7b14bfe0b4f3cf8a1d2419
parent17a4fcd9ae5533ca43b023cf8d7ae3f70a196e0e
[PATCH] [release-branch.go1.15] net: verify results from Lookup* are valid domain names

For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Updates #46241
Fixes #46356
Fixes CVE-2021-33195

Change-Id: I47a4f58c031cb752f732e88bbdae7f819f0af4f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/323131
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
(cherry picked from commit cdcd02842da7c004efd023881e3719105209c908)
Reviewed-on: https://go-review.googlesource.com/c/go/+/323269

Gbp-Pq: Name 0009-CVE-2021-33195-1.patch
src/net/dnsclient_unix_test.go
src/net/lookup.go