[PATCH] [release-branch.go1.15] net: verify results from Lookup* are valid domain...
authorRoland Shoemaker <roland@golang.org>
Thu, 27 May 2021 17:40:06 +0000 (10:40 -0700)
committerShengjing Zhu <zhsj@debian.org>
Tue, 13 Jul 2021 05:55:42 +0000 (06:55 +0100)
commit6da0956070961c903ce04ef96601a9c5b3fb56b4
tree2da8f5ac7845e574fad7bb69000119a991816226
parentbbc037f0323544b0cbe384c45022675e0a006e80
[PATCH] [release-branch.go1.15] net: verify results from Lookup* are valid domain names

For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Updates #46241
Fixes #46356
Fixes CVE-2021-33195

Change-Id: I47a4f58c031cb752f732e88bbdae7f819f0af4f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/323131
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
(cherry picked from commit cdcd02842da7c004efd023881e3719105209c908)
Reviewed-on: https://go-review.googlesource.com/c/go/+/323269

Gbp-Pq: Name 0009-CVE-2021-33195-1.patch
src/net/dnsclient_unix_test.go
src/net/lookup.go