https://downloads.isc.org/isc/bind9/9.19.21/RELEASE-NOTES-bind-9.19.21.html
Security Fixes
- Validating DNS messages containing a lot of DNSSEC signatures could cause
excessive CPU load, leading to a denial-of-service condition. This has
been fixed. (CVE-2023-50387)
ISC would like to thank Elias Heftrig, Haya Schulmann, Niklas Vogel, and
Michael Waidner from the German National Research Center for Applied
Cybersecurity ATHENE for bringing this vulnerability to our attention. [GL #4424]
- Parsing DNS messages with many different names could cause excessive CPU load.
This has been fixed. (CVE-2023-4408)
ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr
from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt
from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4234]
- Specific queries could cause named to crash with an assertion failure when
nxdomain-redirect was enabled. This has been fixed. (CVE-2023-5517) [GL #4281]
- A bad interaction between DNS64 and serve-stale could cause named to crash with an
assertion failure, when both of these features were enabled. This has been fixed.
(CVE-2023-5679) [GL #4334]
Resolves: CVE-2023-50387 CVE-2023-4408 CVE-2023-5517 CVE-2023-5679
https://downloads.isc.org/isc/bind9/9.19.19/doc/arm/html/notes.html#notes-for-bind-9-19-19
New Features
- Initial support for the PROXYv2 protocol was added. named can now accept PROXYv2 headers over all currently implemented DNS transports and dig can insert these headers into the queries it sends. Please consult the related documentation (allow-proxy, allow-proxy-on, listen-on, and listen-on-v6 for named, dig +proxy and dig +proxy-plain for dig) for additional details. [GL #4388]
Removed Features
- Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been removed. The only supported DNS COOKIE algorithm is now the current default, SipHash-2-4. [GL #4421]
- The resolver-nonbackoff-tries and resolver-retry-interval statements have been removed. Using them is now a fatal error. [GL #4405]
Feature Changes
- The maximum number of NSEC3 iterations allowed for validation purposes has been lowered from 150 to 50. DNSSEC responses containing NSEC3 records with iteration counts greater than 50 are now treated as insecure. [GL #4363]
- Following RFC 9276 recommendations, dnssec-policy now only allows an NSEC3 iteration count of 0 for the DNSSEC-signed zones using NSEC3 that the policy manages. [GL #4363]
Upstream has discontinued and remove support for local PDF building in
commit 561a83a29182b00bda9237ae30343d76a68dcdf4. Just remove remaining
bits, it is not likely to return.
It was added in year 2012 without any reference to a bug. Commit
deca2d7733ec49eaf362e3852a38ff53e2826707. I doubt any reason for
that is still relevant today. It was bind 9.9.0, which required it.
Create /etc/pki/tls directory in chroot and mount /etc/pki/tls/cert.pem
file into the chroot. Even though the that file is symlink, mount during
chroot setup will resolve it correctly.
Resolves: rhbz#2196699
Detect current capabilities with help of sudo tool. If addresses are
already configured, then just run tests. If they are not, use capsh to
detect ability to configure network.
Originally added by commit 207484f5d447b8b291e04a7304b16a997e71d10b.
I think those flags are not neede anymore. Some of those became defaults
anyway. Others are part of compilation flags used by the system. Nothing
else should be required. Checking by checksec(8) tool did not reveal any
differences with or without this patch.
I do not want to install this package when dnf install bind-utils is
specified. I want to prefer original bind-utils if they are available.
Install this by bind9-next-utils only, but be able to satisfy bind-utils
requirements from other package.
That works as expected only on recent enough distribution, starting with
f37.
