Software-update: Pi-hole FTL 6.7.1
Versie 6.7.1 van Pi-hole FTL is verschenen. Pi-hole Core en Pi-hole Web zijn ongewijzigd en zitten nog op respectievelijk 6.4.3 en 6.6. Pi-hole is een advertising-aware dns- en webserver bedoeld om te draaien op een Raspberry Pi in het netwerk. Als op de router naar Pi-hole wordt verwezen voor dns-afhandelingen, zullen alle apparaten binnen het netwerk er automatisch gebruik van maken zonder dat er instellingen hoeven te worden aangepast. Vervolgens worden advertenties niet meer opgehaald, waardoor pagina's sneller laden. In potentie kan er ook malware mee buiten de deur worden gehouden. Voor meer informatie verwijzen we jullie door naar de uitleg en video's op deze pagina, deze handleiding van tweaker jpgview, of dit topic op ons forum. De releasenotes voor deze uitgave kunnen hieronder worden gevonden.
Security FixesGHSA-2794-hrj8-5jg9 - Remote code execution and arbitrary file read via webserver.advancedOpts (High) reported by keithlinnemanGHSA-ww5x-xx4x-qvjr - Remote code execution via exec-capable options in misc.dnsmasq_lines (High) reported by keithlinnemanGHSA-gx63-h4w6-f46g - Configuration validators can be bypassed via Teleporter import, combined changes and document-root relocation (High)GHSA-7997-2868-rjfg - Stack buffer overflow in the blocked-answer path (Moderate) reported by 010011110
GHSA-2794-hrj8-5jg9 - Remote code execution and arbitrary file read via webserver.advancedOpts (High) reported by keithlinnemanGHSA-ww5x-xx4x-qvjr - Remote code execution via exec-capable options in misc.dnsmasq_lines (High) reported by keithlinnemanGHSA-gx63-h4w6-f46g - Configuration validators can be bypassed via Teleporter import, combined changes and document-root relocation (High)GHSA-7997-2868-rjfg - Stack buffer overflow in the blocked-answer path (Moderate) reported by 010011110Behavior changesmisc.dnsmasq_lines and webserver.advancedOpts can no longer be changed through the API or the web interface. They can still be set in pihole.toml, through environment variables and with pihole-FTL --config.Wrong-method API requests now return 405 with an Allow header, and OPTIONS names only the methods of the endpoint that fits the URI best.The CAP_NET_RAW startup warning is gone, dnsmasq reports it when it actually needs the capability.database.maxDBdays is an unsigned value now. A negative value kept the queries forever and is migrated to 4294967295, which continues to do so.
misc.dnsmasq_lines and webserver.advancedOpts can no longer be changed through the API or the web interface. They can still be set in pihole.toml, through environment variables and with pihole-FTL --config.Wrong-method API requests now return 405 with an Allow header, and OPTIONS names only the methods of the endpoint that fits the URI best.The CAP_NET_RAW startup warning is gone, dnsmasq reports it when it actually needs the capability.database.maxDBdays is an unsigned value now. A negative value kept the queries forever and is migrated to 4294967295, which continues to do so.Fixes of notepi.hole and the local host name were answered with NODATA until restart once the interface cache went stale (#3050)An infinite loop in the dnsmasq config test when debug.config is enabledWebserver workers spinning at 100% CPU in the mbedTLS debug callback (#3106)Async-signal-safety in the real-time signal handler and the TCP worker terminatorQuery indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committedDatabase connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctnessMemory-safety hardening in the netlink parsers, get_api_string(), base64_decode_update() and arp-scan
pi.hole and the local host name were answered with NODATA until restart once the interface cache went stale (#3050)An infinite loop in the dnsmasq config test when debug.config is enabledWebserver workers spinning at 100% CPU in the mbedTLS debug callback (#3106)Async-signal-safety in the real-time signal handler and the TCP worker terminatorQuery indices that went stale while the shared memory lock was released, and a domain lookup that gave up at once when a list change was being committedDatabase connection leaks and counter skew, gravity regex and search-term handling, config write races, API error paths and response correctnessMemory-safety hardening in the netlink parsers, get_api_string(), base64_decode_update() and arp-scan
Source:
Tweakers.net