Not really a security report (GHSA-4jxw-xjwg-c754)

[samboy]

Let me comment on this “security report”: GHSA-4jxw-xjwg-c754

This is not a real security issue. For the “exploit” to work, as per the report, the attacker needs to control a nameserver Deadwood (MaraDNS) considers trustable; the attack starts off as “the malicious authoritative receives Deadwood's iterative query”

If an upstream server is controlled by an attacker, they can do a hell of a lot more than set QR=0. They can, for example, simply send Deadwood bogus replies.

This is a “they already got on the other side of the secure hatch” issue, not a real vector where one can poison Deadwood’s cache without controlling servers Deadwood considers authoritative.