138
Wouldn't the attacker have to be on the same network as the resolver for this to work? Or could it be triggered by a "dirty hostname"? Because in the former case, most home networks would not be at much risk.
It's the latter. Unless you run your own DNS resolver, most people are safe
Thanks for the heads -up.
Sorry if this is a basic question. So if I have a pihole, do I just need to update the Raspberry Pi software, along with updating pihole software to resolve the insecurities? Or do I need to change the DNS settings of the pihole?
If you use a third-party's DNS server (such as Cloudflare, Quad9 or Google) as your upstream DNS server, you only have to update PiHole.
If you have set up your own upstream DNS server using a DNS resolver like unbound or Bind9, update it as well as your PiHole.
Makes sense, thanks for the response.
You need to update Pihole
My unbound is on v1.13.1 (Raspbian) after update/upgrade. I've read it lags behind the main release by alot, should I trust the process that everything is fine.
Its up to your distros package maintainer to make the patched version available. You can find who maintains it and contact them so they are aware.
Debian usually backports security fixes to older versions, so you may wanna check to Debian if they have an updated version of the package with the security fix.
This can be done by taking the CVE number related to this vulnerability and look at the package changelog.
Cheers
I'm on DietPi 9 and the latest version for Debian 12 is 1.17.1, sadly. Though I do see 1.19.1 is in testing as of today, according to Debian's package tracker site. Probably not worth trying to install an unstable version of it.
I installed it now, it is working fine with my pihole. It wasnt that much of a hussle but a bit of googling.
What's the status of SmartDNS (that is used by OpenWRT and DD-WRT) on this? Anyone knows anything?
I struggle to find if it uses DNSSEC or even a change log. If it does, contact the maintainer and disable DNSSEC (if you can) until a fix is released.
What about on mobile? Those of us who use dns filtering on mobile.
I'm not familiar with off-the-shelf DNS filtering on mobile, but since running a DNS resolver on-device would be impractical, I think they must be using a DNS server that they maintain. Which means that unless I'm wrong, the vulnerability lies on their end, you should be fine.
I been using rethink dns but ik their are other for android at least. Works by making a local vpn magic.
They maintain their own resolver, so they have to patch it if not done already.
Not sure why, but on Synology with docker, the pihole:latest releases are usually a mess and restoring settings and client lists does not work. Unfortunately, only “latest -2” seems to work most of the time.
¯\_(ツ)_/¯
this post was submitted on 16 Feb 2024
138 points (99.3% liked)
Selfhosted
40183 readers
497 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 1 year ago
MODERATORS