https://www.kb.cert.org/vuls/id/471747 - DoS, Cache Poisoning / Redirection, Information Disclosure, Local Privilege Escalation...
So?
What happens to 25.12 branch that is still on 2.91 but also affected? Will dnsmasq get bumped on the stable branch?
@hnyman this question should be adressed to someone like you.
@dave14305 highly unlikely because 2.92 is more than just a bugfix release and contains new features and changes to DNSSEC logic.
Maybe OpenWrt 25.12 will pick up the debian trixie patches for 2.91.
Based on the dnsmasq author's own comments, the patches should be applicable to 2.91 sources, too. Apparently only one patch needs changes compared to 2.92: https://thekelleys.org.uk/dnsmasq/CVE/
But it will require a separate patch PR to be created for 2.91 in 25.12.x.
My PR has now been committed to the 25.12 branch for dnsmasq 2.91, and also to main/master with the 2.92 specific patch included. So, both new 25.12 builds and new main/master snapshot builds should be ok.
Should this be backported to 24.10?
Thanks to everyone involved for the quick solution, dnsmasq 2.91-r3 is working!
Hauke did that: