Tweakers · Technology

Pi-hole FTL 6.7.1 Released with Important Security Fixes

Version 6.7.1 of Pi-hole FTL has been released, with updates for the FTL component while Pi-hole Core and Web remain unchanged. Pi-hole is a network-wide DNS server that blocks ads and potentially keeps malware out.

The update includes multiple security fixes, including solutions for remote code execution and arbitrary file reads via the web server, and configuration validation bypasses via Teleporter. A stack buffer overflow in the response path for blocked requests has also been addressed.

Certain configuration options such as misc.dnsmasq_lines and webserver.advancedOpts can no longer be changed via the API or web interface, but can be changed via pihole.toml, environment variables, or pihole-FTL --config.

API requests with an incorrect method now return a 405 response with an Allow header, and OPTIONS requests specify the methods of the most suitable endpoint.

The warning for CAP_NET_RAW at startup has been removed; dnsmasq now only reports this when the capability is actually needed.

The database.maxDBdays is now an unsigned value; a negative value, which previously saved all queries, is migrated to 4294967295, which continues the same behavior.

Important fixes include correctly answering pi.hole and local hostnames, resolving an infinite loop in the dnsmasq configuration test, and preventing 100% CPU usage by webserver workers.

Further improvements include memory safety in netlink parsers, API functions, and base64 decoding, as well as resolving database leaks, query indices becoming stale, and race conditions when writing configurations.

AI-samenvatting op basis van de bron.