Pi-hole v6.6 released

Pi-hole is the well-known network-wide ad blocker, running as a DNS sinkhole on a Raspberry Pi or any other Linux box.

Pi-hole v6.6 is mainly a security release. It fixes five high severity and one medium severity advisory in the core scripts:

pihole -r and pihole -up followed symlinks in /etc/pihole, so a pihole user could get root to take over files (CVSS 7.3)
root followed symlinks and config-supplied paths during the macvendor.db download, pihole checkout and pihole uninstall (CVSS 7.3)
pihole -d followed symlinks in pihole-owned directories (CVSS 7.3)
gravity.sh spliced files.gravity unescaped into SQL, letting an admin run commands as pihole (CVSS 7.2)
the debug log, and so a tricorder upload, included the web password hash, app password hash and TOTP secret (medium, CVSS 5.3)

Under the hood, Pi-hole now drops from root to the pihole user with setpriv instead of sudo, so sudo is no longer required. The installer writes files as pihole instead of root, and log rotation now relies on the system’s daily logrotate instead of rotating twice.

Smaller changes:

Fixes for pihole flush output, pihole updatechecker writing null hashes and pihole -v showing N/A
Warning when a local repository is not marked as safe for git
Quad9's unfiltered upstream is now marked as validating DNSSEC
Unneeded CAP_IPC_LOCK removed
Fedora 45 added to the tests, test suite runs with podman

Updating is highly recommended:

pihole -up

Full release notes with all advisory links are available on the GitHub release page.

Happy blocking! :-)

• News
• Tools