github/coredns.io
4
0
Fork 0
mirror of https://github.com/coredns/coredns.io.git synced 2024-04-21 12:32:00 +00:00
Code Issues Releases Wiki Activity

Trail of Bits Security Review Blog Post (#252)

Browse Source 
* trail of bits security review blog post

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* trail of bits feedback

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* add links to PRs

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* add more links to PRs

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* quote summary from report; add another PR; use TOB's ID style; use generic author

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* add three PRs for issue 12

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* use known good pubplications url instead of directly to reports that are not published yet

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* Reword in case this is published before the reports are published

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>

* update link to published report

Signed-off-by: Chris O'Haver <cohaver@infoblox.com>
This commit is contained in:
Chris O'Haver
2022-03-23 12:16:17 -07:00
committed by GitHub
parent 66c811638c
commit bf93ee5695
1 changed files with 37 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/blog/trail-of-bits-security-review.md
+37
View File
@@ -0,0 +1,37 @@
+++
title = "Trail Of Bits Security Review"
description = "A security review of CoreDNS conducted by Trail of Bits"
tags = ["Security Review", "Threat Model", "Trail of Bits"]
date = "2022-02-24T00:00:00-00:00"
author = "coredns"
+++
Trail of Bits (https://trailofbits.com) conducted a security review and threat model of CoreDNS.
Quoting from the security review summary:
> "The audit uncovered one high-severity issue (TOB-CDNS-8) concerning a bug that could lead to cache poisoning attacks.
> The majority of the other issues are of informational or low severity; these include several resulting from insufficient
> data validation, specifically from assumptions about the data processed by various functions, which we discovered by
> running fuzzing harnesses. Most of the findings pertain to denial-of-service vulnerabilities."
The report can be found in Trail of Bits' publications on GitHub: https://github.com/trailofbits/publications/blob/master/reviews/CoreDNS.pdf
At this time, the following PRs have been opened to address issues raised in the report:
* https://github.com/coredns/coredns/pull/5085 (TOB-CDNS-1)
* https://github.com/coredns/coredns/pull/5108 (TOB-CDNS-5)
* https://github.com/coredns/coredns/pull/5168 (TOB-CDNS-2)
* https://github.com/coredns/coredns/pull/5169 (TOB-CDNS-3)
* https://github.com/coredns/coredns/pull/5170 (TOB-CDNS-4)
* https://github.com/coredns/coredns/pull/5171 (TOB-CDNS-15)
* https://github.com/coredns/coredns/pull/5172 (TOB-CDNS-11)
* https://github.com/coredns/coredns/pull/5173 (TOB-CDNS-9)
* https://github.com/coredns/coredns/pull/5174 (TOB-CDNS-8)
* https://github.com/coredns/coredns/pull/5220 (TOB-CDNS-10)
* https://github.com/coredns/coredns/pull/5224 (TOB-CDNS-14)
* https://github.com/coredns/coredns/pull/5225 (TOB-CDNS-7)
* https://github.com/coredns/coredns/pull/5226 (TOB-CDNS-6)
* https://github.com/coredns/coredns/pull/5227 (TOB-CDNS-12)
* https://github.com/coredns/coredns/pull/5228 (TOB-CDNS-12)
* https://github.com/coredns/coredns/pull/5231 (TOB-CDNS-12)