v6: CVE-2021-23386: update dns-packet

[apepper]

Thank you for bumping dns-packet in #74 for version 7.

Could you also release a security bump for version 6? This currently affects webpack-dev-server via a different (no longer maintained) library, that still makes use of multicast-dns version 6:

https://github.com/watson/bonjour/blob/bdc467a4f3c7b9fe8bc54468b6fc4d80b8f1c098/package.json#L11

More details can be found at webpack/webpack-dev-server#3340.

[mafintosh]

It's already fixed for v6 if you reinstall deps, I backported it on dns-packet to the version multicast-dns 6 is tracking :)

[bobvandevijver]

@mafintosh If you could make that known to the advisory, it might work. See https://www.npmjs.com/advisories/1745/versions

[mafintosh]

I already did

[apepper]

It's already fixed for v6 if you reinstall deps, I backported it on dns-packet to the version multicast-dns 6 is tracking :)

Sounds great! Is this already available on npm? At least for me npm show multicast-dns@6 version does not list 6.2.4 or newer to me. The last version 6 release that I can see on npm is three years old: https://www.npmjs.com/package/multicast-dns/v/6.2.3

[mafintosh]

dns-packet is where the update is. multicast-dns v6 tracks v1 which is where i backported the fix. do you know if i need to backport a version bump to multicast-dns as well for this security sillyness to stop?

[mafintosh]

fyi this is the dns-packet backport https://github.com/mafintosh/dns-packet/tree/v1

[apepper]

dns-packet is where the update is.

Ah, awesome. Thank your for fixing it at the very source!

[mafintosh]

I sent SNYK an email bump now also to get them to update the advisory

[jaredbeck]

fyi this is the dns-packet backport https://github.com/mafintosh/dns-packet/tree/v1

I sent SNYK an email bump now also to get them to update the advisory

Can you please confirm that

1. dns-packet 1.3.4 fixes the vulnerability (specifically mafintosh/dns-packet@ac57872), and
2. the advisory has not yet been updated accordingly

Thanks.

[mafintosh]

advisory is updated, just checked