Announcement date: August 18, 2025
What's new
Dashboard enhancements to track unique IPs and top IP addresses by query count
- Unique IPs—displays a graph of unique IP addresses that have performed queries over the last 90 days.
- Top IP addresses by query count—displays a list of the top IP addresses performing queries over the past 24 hours.
Support for new API keys for Cisco Umbrella
BlueCat Edge v25.2 introduces enhancements to the support the new Cisco Umbrella API keys. If you are using legacy Cisco Umbrella keys, BlueCat Edge informs you that you are using Legacy API keys.
- DNS resolver service ID: The ID of the DNS resolver service that the query passed through
- Namespace ID: The ID of the namespace that the query passed through
- Protocol: The protocol (TCP/UDP) that the query uses.
- Answer TTL: The TTL of the query answer.
What's new
Support for provisioning Service Point on KVM
Service Point v25.2.1 introduces support for provisioning the Service Point on KVM installed on CentOS 9, CentOS 10, and Ubuntu 24.04 LTS operating systems.
Support for provisioning Service Point on Cisco 8200 devices
Service Point v25.2.1 introduces support for provisioning the Service Point on Cisco 8200 devices using NFVIS. With this introduction, the Cisco ENCS and Cisco ENCS (small disk) Service Point download images have been renamed to Cisco NFV and Cisco NFV (small disk) respectively. Additionally, when configuring a Service Point on Cisco 8200 or ENCS in the Edge CI, the Cisco ENCS value under Platform has been renamed to Cisco NFV.
Resolved issues
Anycast service exits unexpectedly upon Service Point update
Previously, when a Service Point would update from version 4.7.1 to 25.2.0 with Anycast service enabled, the Anycast (FRR) service would exit unexpectedly after rebooting.
BlueCat Edge v25.2.1 resolves the following security vulnerabilities:
| CVE | Description |
|---|---|
| CVE-2020-12762 | json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend. |
| CVE-2023-7008 | A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records. |
| CVE-2023-50387 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG records, the protocol specification implies that an algorithm must evaluate all combinations of DNSKEY and RRSIG records. |
| CVE-2023-50868 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. The RFC 5155 specification implies that an algorithm must perform thousands of iterations of a hash function in certain situations. |
| CVE-2025-4598 | A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality. |
| CVE-2025-5222 | A stack buffer overflow was found in Internationl components for unicode (ICU). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution. |
| CVE-2025-6021 | A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input. |
| CVE-2025-32462 | Sudo before 1.9.17p1, when used with a sudoers file that specifies a host that is neither the current host nor ALL, allows listed users to execute commands on unintended machines. |
| CVE-2025-49794 | A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or other possible undefined behaviors. |
| CVE-2025-49796 | A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive data being corrupted in memory. |