Security fixes:
- DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677)
- Address various spoofing attacks. (CVE-2025-40778)
- Cache-poisoning due to weak pseudo-random number generator.
(CVE-2025-40780)
New Features:
- Support for parsing HHIT and BRID records has been added.
Removed Features:
- Deprecate the "tkey-domain" statement.
- Deprecate the "tkey-gssapi-credential" statement.
Bug Fixes:
- Prevent spurious SERVFAILs for certain 0-TTL resource records.
- Missing DNSSEC information when CD bit is set in query.
https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-bind-9-18-41
Use the same name in dig or host utilities when stdout is not a
terminal. Until now it disabled IDN processing when stdout were not a
terminal. Disable just IDN output in that case and try to decode input
name with IDN. Keep failing in interactive sessions, but send even
undecoded name query when output is redirected.
That should limit new surprises and keep most of behaviour without
changes. But do not break in when input name failed to decode and
it were not trying to decode it before.
Related: RHEL-66172
New Features:
- Support for parsing the DSYNC record has been added.
Feature Changes:
- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.
Bug Fixes:
- Clean enough memory when adding new ADB names/entries under memory pressure.
- Rescan the interfaces again when reconfiguring the server.
https://downloads.isc.org/isc/bind9/9.18.39/doc/arm/html/notes.html#notes-for-bind-9-18-39
Security Fixes:
- Fix an issue when some specific queries could remain unanswered with serve-stale enabled.
New Features:
- Add support for the CO flag to dig.
Bug fixes:
- Correct the default interface-interval from 60s to 60m.
- Fix a purge-keys bug when using multiple views of a zone.
resume_qmin did not handle special case of recursing query hit
unexpected DNS_R_CNAME result. Change result to SERVFAIL in case
of a zone loaded after the recursion started. That prevents crashing
later in query_setorder, where there is uninitialized foundname compared
with absolute order names.
https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
Related: RHEL-30407
Now https://src.fedoraproject.org/rpms/rpm/pull-request/61 has
landed, packages that set up users and groups must have user(x)
and group(x) provides. If bind used the mechanism recommended in
the guidelines for creating users and groups, this would happen
automatically, but it does not, so this just adds explicit
Provides as a minimal short-term fix.
Signed-off-by: Adam Williamson <awilliam@redhat.com>
It fails only on s390x, but cannot be disabled just on one arch when the
package is noarch. Disable it until resolved.
Related: rhbz#2332076
(cherry picked from commit ad87dca169)
- Remove CHANGES file from package
Removed Features:
- Disable DLZ plugins, they are not shipped with bind anymore
New Features:
- new 2024 KSK root key
Feature Changes:
- max-records-per-type and max-types-per-name improved logging when
reached over their value
And NSEC3 and two dig bug fixes.
https://downloads.isc.org/isc/bind9/9.18.32/doc/arm/html/notes.html#notes-for-bind-9-18-32
(cherry picked from commit 7d1027aabf)
Security Fixes:
- DNS-over-HTTPS flooding fixes. (CVE-2024-12705)
- Limit additional section processing for large RDATA sets. (CVE-2024-11187)
New Features:
- Add a new option to configure the maximum number of outgoing queries per client request.
Bug Fixes:
- Fix nsupdate hang when processing a large update.
- Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006]
- Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
- Fix improper handling of unknown directives in resolv.conf.
https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33
(cherry picked from commit c72c74cce0)
- Print the full path of the working directory in startup log messages.
- Follow the number of CPUs set by taskset/cpuset.
- Verification of the privacy of an EDDSA key was broken.
- Fix algorithm rollover bug when there are two keys with the same keytag.
https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-30
Update to 9.18.29
Feature Changes:
- Tighten max-recursion-queries and add max-query-restarts configuration statement.
- Raise the log level of priming failures.
- Add a compatibility shim for older libuv versions (< 1.19.0)
Bug Fixes:
Return SERVFAIL for a too long CNAME chain.
- Reconfigure catz member zones during named reconfiguration.
- Update key lifetime and metadata after dnssec-policy reconfiguration.
- Fix generation of 6to4-self name expansion from IPv4 address.
- dig +yaml was producing unexpected and/or invalid YAML. output. [GL #4796] [GL !9214]
- SVBC ALPN text parsing failed to reject zero-length ALPN. [GL #4775] [GL !9210]
- Fix false QNAME minimisation error being reported.
- Fix dig +timeout argument when using +https.
https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-29
Most ENGINE-related includes and code are already so guarded, this fixes
the last unguarded cases, and allows bind to build without
openssl-devel-engine (e.g. in RHEL 10 and ELN).
Move license to libs subpackage, it is required for everything except
documentation. Include license file in docs and bind-libs, avoid extra
package just for single file.
https://downloads.isc.org/isc/bind9/9.18.21/doc/arm/html/notes.html#notes-for-bind-9-18-21
Removed Features
- Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead. [GL #4421]
- The resolver-nonbackoff-tries and resolver-retry-interval statements have been deprecated. Using them now causes a warning to be logged. [GL #4405]
