spamhaus/dnsdbq: 5-MOAD scan; dnsdbq-0001 CWE-312 API keys logged verbatim in debug mode
rbldnsd (C, DNS blocklist server): CLEAN all 5 MOADs
- MOAD-0001 CWE-407: CLEAN — all query paths use sorted arrays + binary search
(ds_dnset_find, ds_ip4set_find, ds_ip4tset_find, ds_generic_find all O(log N))
- MOAD-0002 Intertangle: CLEAN — single-threaded, clear separation of zones/datasets
- MOAD-0003 Leaked Context: CLEAN — no thread-local state, no threading at all
- MOAD-0004 Logged Secret: CLEAN — no credential handling in rbldnsd
- MOAD-0005 Thundering Herd: CLEAN — single-threaded, signal-based reload
dnsdbq (C, pDNS CLI tool, github.com/spamhaus/dnsdbq):
- dnsdbq-0001 MOAD-0004 CWE-312 HIGH: API keys and auth credentials logged
verbatim to stderr when -v (debug) flag is used. Two sites:
(1) dnsdbq.c:862 logs every raw config file line including
"apikey <secret>", "circla user:password", "deteque_t token",
"deteque_a authinfo"
(2) dnsdbq.c:915 logs DNSDB_API_KEY env var verbatim
Fix: redact credential values, log key name + [REDACTED]
pdns-logger (C, PowerDNS logging daemon): CLEAN all 5 MOADs
rdap (Go, RDAP client library): CLEAN all 5 MOADs
russell@unturf.com
e123ca2fc8