Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net: Lookup functions may return invalid host names [1.16 backport] #46357

Closed
gopherbot opened this issue May 24, 2021 · 5 comments
Closed

net: Lookup functions may return invalid host names [1.16 backport] #46357

gopherbot opened this issue May 24, 2021 · 5 comments
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Milestone
Go1.16.5

Comments

@gopherbot
Copy link
Contributor

@rolandshoemaker requested issue #46241 to be considered for backport to the next 1.16 minor release.

@gopherbot please consider this for backport to 1.15 and 1.16 as this is a security issue.
@gopherbot gopherbot added the CherryPickCandidate Used during the release process for point releases label May 24, 2021
@gopherbot gopherbot mentioned this issue May 24, 2021
Closed
@gopherbot gopherbot added this to the Go1.16.5 milestone May 24, 2021
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/322230 mentions this issue: [release-branch.go1.16] net: verify results from Lookup* are valid domain names

@mknyszek
Copy link
Contributor

Since this appears to be a security issue with no apparent workaround, approved.

@mknyszek mknyszek added CherryPickApproved Used during the release process for point releases and removed CherryPickCandidate Used during the release process for point releases labels May 25, 2021
@gopherbot
Copy link
Contributor Author

Change https://golang.org/cl/323270 mentions this issue: [release-branch.go1.16] net: verify results from Lookup* are valid domain names

gopherbot pushed a commit that referenced this issue May 27, 2021
@rolandshoemaker
[release-branch.go1.16] net: verify results from Lookup* are valid do…
df6a737 
…main names

For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Updates #46241
Fixes #46357
Fixes CVE-2021-33195

Change-Id: I47a4f58c031cb752f732e88bbdae7f819f0af4f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/323131
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
(cherry picked from commit cdcd028)
Reviewed-on: https://go-review.googlesource.com/c/go/+/323270
@gopherbot
Copy link
Contributor Author

Closed by merging df6a737 to release-branch.go1.16.

@horkhe
Copy link

horkhe commented Jun 29, 2021 •
edited
Loading

Because of this change if a domain has a Null MX record (https://tools.ietf.org/html/rfc7505) configured, then net.LookupMX returns &net.DNSError{Err: "MX target is invalid", Name: name} (e.g. example.com). Therefore it is impossible to make a decision whether sender should avoid trying to make an SMTP connection to an IP given by the domain A record.

EDIT: Also previously there was a way to filter out invalid records and connect to valid ones. Now one invalid MX record results in net.LookupMX failure, so if the domain has some valid MX records the caller would not know about that.

@golang golang locked and limited conversation to collaborators Jun 29, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
CherryPickApproved Used during the release process for point releases FrozenDueToAge release-blocker Security
Projects
None yet
Milestone
Go1.16.5
Development

No branches or pull requests
4 participants
@horkhe @FiloSottile @mknyszek @gopherbot