c-ares-1.17.1

[Bruce Dubbs]

New minor version.

[Xi Ruoyao]

It FTBFS:

​https://github.com/c-ares/c-ares/issues/373

[Xi Ruoyao]

We can download those two files from GitHub, or wait for next release.

[Bruce Dubbs]

It sounds like a new release is coming soon. Let's wait for that.

[Douglas R. Reno]

I'll check later on today. This version has four security fixes in it, at least one of them rated as high with no user intervention required to exploit. The node.js update is related.

[Douglas R. Reno]

I did poke upstream on this about half an hour ago. The purpose of Node.JS-14.15.1 is:

Commits

    [1fd2c8142b] - deps: cherry-pick 0d252eb from upstream c-ares (Michael Dawson) nodejs-private/node-private#231

There isn't a reason for us to update Node.JS until this is updated because we use the system version of c-ares. Those two really should go in at the same time.

[Douglas R. Reno]

Now 1.17.1!

[Douglas R. Reno]

 c-ares version 1.17.1 - Nov 19 2020

Fixes packaging issues in 1.17.0.

c-ares version 1.17.0 - Nov 16 2020

Security:

    avoid read-heap-buffer-overflow in ares_parse_soa_reply found during fuzzing
    Avoid theoretical buffer overflow in RC4 loop comparison
    Empty hquery->name could lead to invalid memory access
    ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was passed in 

Changes:

    Update help information for adig, acountry, and ahost
    Test Suite now uses dynamic system-assigned ports rather than hardcoded ports to prevent failures in containers
    Detect remote DNS server does not support EDNS using rules from RFC 6891
    Source tree has been reorganized to use a more modern layout
    Allow parsing of CAA Resource Record 

Bug fixes:

    readaddrinfo bad sizeof()
    Test cases should honor HAVE_WRITEV flag, not depend on WIN32
    FQDN with trailing period should be queried first
    ares_getaddrinfo() was returning members of the struct as garbage values if unset, and was not honoring ai_socktype and ai_protocol hints.
    ares_gethostbyname() with AF_UNSPEC and an ip address would fail
    Properly document ares_set_local_ip4() uses host byte order 

[Douglas R. Reno]

Marked as high due to four security vulnerabilities

[Douglas R. Reno]

Fixed at r14252