Commit df6a737c authored by Roland Shoemaker's avatar Roland Shoemaker
Browse files

[release-branch.go1.16] net: verify results from Lookup* are valid domain names

For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Updates #46241
Fixes #46357
Fixes CVE-2021-33195

Change-Id: I47a4f58c031cb752f732e88bbdae7f819f0af4f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/323131


Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: default avatarFilippo Valsorda <filippo@golang.org>
Reviewed-by: default avatarKatie Hockman <katie@golang.org>
(cherry picked from commit cdcd0284)
Reviewed-on: https://go-review.googlesource.com/c/go/+/323270
parent 9210eaf7
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment