linux/poky.git/meta/recipes-connectivity/bind, branch yocto-4.0.14

bind: update to 9.18.19

2023-09-30T19:43:59+00:00

Notes for BIND 9.18.19 Security Fixes Previously, sending a specially crafted message over the control channel could cause the packet-parsing code to run out of available stack memory, causing named to terminate unexpectedly. This has been fixed. (CVE-2023-3341) ISC would like to thank Eric Sesterhenn from X41 D-Sec GmbH for bringing this vulnerability to our attention. [GL #4152] A flaw in the networking code handling DNS-over-TLS queries could cause named to terminate unexpectedly due to an assertion failure under significant DNS-over-TLS query load. This has been fixed. (CVE-2023-4236) ISC would like to thank Robert Story from USC/ISI Root Server Operations for bringing this vulnerability to our attention. [GL #4242] Removed Features The dnssec-must-be-secure option has been deprecated and will be removed in a future release. [GL #4263] Feature Changes If the server command is specified, nsupdate now honors the nsupdate -v option for SOA queries by sending both the UPDATE request and the initial query over TCP. [GL #1181] Bug Fixes The value of the If-Modified-Since header in the statistics channel was not being correctly validated for its length, potentially allowing an authorized user to trigger a buffer overflow. Ensuring the statistics channel is configured correctly to grant access exclusively to authorized users is essential (see the statistics-channels block definition and usage section). [GL #4124] This issue was reported independently by Eric Sesterhenn of X41 D-Sec GmbH and Cameron Whitehead. The Content-Length header in the statistics channel was lacking proper bounds checking. A negative or excessively large value could potentially trigger an integer overflow and result in an assertion failure. [GL This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. Several memory leaks caused by not clearing the OpenSSL error stack were fixed. [GL #4159] This issue was reported by Eric Sesterhenn of X41 D-Sec GmbH. The introduction of krb5-subdomain-self-rhs and ms-subdomain-self-rhs UPDATE policies accidentally caused named to return SERVFAIL responses to deletion requests for non-existent PTR and SRV records. This has been fixed. [GL #4280] The stale-refresh-time feature was mistakenly disabled when the server cache was flushed by rndc flush. This has been fixed. [GL #4278] BIND’s memory consumption has been improved by implementing dedicated jemalloc memory arenas for sending buffers. This optimization ensures that memory usage is more efficient and better manages the return of memory pages to the operating system. [GL #4038] Previously, partial writes in the TLS DNS code were not accounted for correctly, which could have led to DNS message corruption. This has been fixed. [GL #4255] Known Issues There are no new known issues with this release. See above for a list of all known issues affecting this BIND 9 branch. Notes for BIND 9.18.18 Feature Changes When a primary server for a zone responds to an SOA query, but the subsequent TCP connection required to transfer the zone is refused, that server is marked as temporarily unreachable. This now also happens if the TCP connection attempt times out, preventing too many zones from queuing up on an unreachable server and allowing the refresh process to move on to the next configured primary more quickly. [GL #4215] The dialup and heartbeat-interval options have been deprecated and will be removed in a future BIND 9 release. [GL #3700] Bug Fixes Processing already-queued queries received over TCP could cause an assertion failure, when the server was reconfigured at the same time or the cache was being flushed. This has been fixed. [GL #4200] Setting dnssec-policy to insecure prevented zones containing resource records with a TTL value larger than 86400 seconds (1 day) from being loaded. This has been fixed by ignoring the TTL values in the zone and using a value of 604800 seconds (1 week) as the maximum zone TTL in key rollover timing calculations. [GL #4032] Known Issues There are no new known issues with this release. See above for a list of all known issues affecting this BIND 9 branch. Link to release notes: https://bind9.readthedocs.io/en/v9.18.19/notes.html#notes-for-bind-9-18-19 (From OE-Core rev: b88fe4581a48c1639764266380921d452a9b6132) Signed-off-by: Lee Chee Yang Signed-off-by: Steve Sakoman

bind: 9.18.11 -> 9.18.17

2023-08-26T14:24:02+00:00

upgrade also include fix for CVE-2023-2829. License-Update: removed trailing whitespace from COPYRIGHT also remove obsolete configuration option epoll and devpoll: https://github.com/isc-projects/bind9/commit/6b6076c882a00028197b04a827f6cf8e7a5369de (From OE-Core rev: f240a373266bd778f380a0611ccf0183d24f76b6) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman

bind : fix CVE-2023-2828 & CVE-2023-2911

2023-07-21T16:27:34+00:00

Backport fixes for: * CVE-2023-2828 - Upstream-Status: Backport from https://gitlab.isc.org/isc-projects/bind9/-/commit/e9d5219fca9f6b819d953990b369d6acfb4e952b * CVE-2023-2911 - Upstream-Status: Backport from https://gitlab.isc.org/isc-projects/bind9/-/commit/240caa32b9cab90a38ab863fd64e6becf5d1393c && https://gitlab.isc.org/isc-projects/bind9/-/commit/ff5bacf17c2451e9d48c78a5ef96ec0c376ff33d (From OE-Core rev: 08810d3fe6988ea821805eca16105b4632335654) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman

bind: upgrade 9.18.10 -> 9.18.11

2023-02-24T16:41:46+00:00

Stable branch update License-update: copyright years (From OE-Core rev: e9e54549426ccfac2c8da4053754f648e42a6c4a) Signed-off-by: Alexander Kanavin Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie (cherry picked from commit 63e8a8952c3d1b3b5c481be6bba52a3f4d65648e) Signed-off-by: Steve Sakoman (cherry picked from commit 54e2de8a589766c9a305c9bd0782afb5353fd109) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.9 -> 9.18.10

2023-01-15T11:05:14+00:00

Changelog: ========== The key file IO locks objects would never get deleted from the hashtable due to off-by-one error. ANY responses could sometimes have the wrong TTL. Speed up the named shutdown time by explicitly canceling all recursing ns_client objects for Removing a catalog zone from catalog-zones without also removing the referenced zone could leave a dangling pointer. [GL #3683] nslookup and host were not honoring the selected port in TCP mode. [GL #3721] Deprecate alt-transfer-source, alt-transfer-source-v6 and use-alt-transfer-source. [GL #3694] Move the "final reference detached" log message from dns_zone unit to the DEBUG(1) log level. Fix assertion failure in isc_http API used by statschannel if the read callback would be called on HTTP request that has been already closed. Deduplicate time unit conversion factors. Copy TLS identifier when setting up primaries for catalog member zones. Deprecate 'auto-dnssec'. [GL #3667] The decompression implementation in dns_name_fromwire() is now smaller and faster. [GL #3655] Use the current domain name when checking answers from a dual-stack-server. Ensure 'named-checkconf -z' respects the check-wildcard option when loading a zone. [GL #1905] Deprecate 'coresize', 'datasize', 'files', and 'stacksize' named.conf options. The view's zone table was not locked when it should have been leading to race conditions when external extensions that manipulate the zone table where in use. Some browsers (Firefox) send more than 10 HTTP headers. Bump the number of allowed HTTP headers to 100. [GL #3670] NXDOMAIN cache records are no longer retained in the cache after expiry, even when serve-stale is in use. [GL #3386] (From OE-Core rev: 932546383875692c4cc9e05c75a4be64a6c3f0c7) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie (cherry picked from commit 1c093c38e247b522f279f616d16373795a4cdf89) Signed-off-by: Steve Sakoman (cherry picked from commit 410d69c684ba4eb6dd279a40436043259f94b6b9) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.8 -> 9.18.9

2022-12-23T23:05:49+00:00

Changelog: =========== Fix a crash that could happen when you change a dnssec-policy zone with NSEC3 to start using inline-signing. [GL #3591] Don't trust a placeholder KEYDATA from the managed-keys zone by adding it into secroots. [GL #2895] Fixed a race condition that could cause a crash in dns_zone_synckeyzone(). [GL #3617] Don't enforce the jemalloc use on NetBSD. [GL #3634] Fix an inheritance bug when setting the port on remote servers in configuration. [GL #3627] Fix a resolver prefetch bug when the record's TTL value is equal to the configured prefetch eligibility value, but the record was erroneously not treated as eligible for prefetching. [GL #3603] Always call dns_adb_endudpfetch() after calling dns_adb_beginudpfetch() for UDP queries in resolver.c, in order to adjust back the quota. [GL #3598] Fix a startup issue on Solaris systems with many (reportedly > 510) CPUs. Thanks to Stacey Marshall from Oracle for deep investigation of the problem. [GL #3563] rpz-ip rules could be ineffective in some scenarios with CD=1 queries. [GL #3247] The RecursClients statistics counter could overflow in certain resolution scenarios. [GL #3584] Less ceremonial UNEXPECTED_ERROR() and FATAL_ERROR() reporting macros. [GL !6914] Fix a couple of bugs in cfg_print_duration(), which could result in generating incomplete duration values when printing the configuration using named-checkconf. [GL !6880] Refactor the isc_httpd implementation used in the statistics channel. [GL !6879] (From OE-Core rev: 38219ac0617eac1969e4535a7dd22bf4c1fa1463) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni (cherry picked from commit e57fe26b3f85ebfabdc8b574caa5c97602e4d771) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.7 -> 9.18.8

2022-11-24T15:30:00+00:00

Changelog: https://gitlab.isc.org/isc-projects/bind9/-/blob/v9_18_8/CHANGES --- 9.18.7 released --- 5962. [security] Fix memory leak in EdDSA verify processing. (CVE-2022-38178) [GL #3487] 5960. [security] Fix serve-stale crash that could happen when stale-answer-client-timeout was set to 0 and there was a stale CNAME in the cache for an incoming query. (CVE-2022-3080) [GL #3517] 5959. [security] Fix memory leaks in the DH code when using OpenSSL 3.0.0 and later versions. The openssldh_compare(), openssldh_paramcompare(), and openssldh_todns() functions were affected. (CVE-2022-2906) [GL #3491] 5958. [security] When an HTTP connection was reused to get statistics from the stats channel, and zlib compression was in use, each successive response sent larger and larger blocks of memory, potentially reading past the end of the allocated buffer. (CVE-2022-2881) [GL #3493] 5957. [security] Prevent excessive resource use while processing large delegations. (CVE-2022-2795) [GL #3394] 5956. [func] Make RRL code treat all QNAMEs that are subject to wildcard processing within a given zone as the same name. [GL #3459] 5955. [port] The libxml2 library has deprecated the usage of xmlInitThreads() and xmlCleanupThreads() functions. Use xmlInitParser() and xmlCleanupParser() instead. [GL #3518] 5954. [func] Fallback to IDNA2003 processing in dig when IDNA2008 conversion fails. [GL #3485] 5953. [bug] Fix a crash on shutdown in delete_trace_entry(). Add mctx attach/detach pair to make sure that the memory context used by a memory pool is not destroyed before the memory pool itself. [GL #3515] 5952. [bug] Use quotes around address strings in YAML output. [GL #3511] 5951. [bug] In some cases, the dnstap query_message field was erroneously set when logging response messages. [GL #3501] 5948. [bug] Fix nsec3.c:dns_nsec3_activex() function, add a missing dns_db_detachnode() call. [GL #3500] 5947. [func] Change dnssec-policy to allow graceful transition from an NSEC only zone to NSEC3. [GL #3486] 5946. [bug] Fix statistics channel's handling of multiple HTTP requests in a single connection which have non-empty request bodies. [GL #3463] 5945. [bug] If parsing /etc/bind.key failed, delv could assert when trying to parse the built in trust anchors as the parser hadn't been reset. [GL !6468] 5944. [bug] Fix +http-plain-get and +http-plain-post options support in dig. Thanks to Marco Davids at SIDN for reporting the problem. [GL !6672] 5942. [bug] Fix tkey.c:buildquery() function's error handling by adding the missing cleanup code. [GL #3492] 5941. [func] Zones with dnssec-policy now require dynamic DNS or inline-siging to be configured explicitly. [GL #3381] 5938. [bug] An integer type overflow could cause an assertion failure when freeing memory. [GL #3483] 5936. [bug] Don't enable serve-stale for lookups that error because it is a duplicate query or a query that would be dropped. [GL #2982] 5935. [bug] Fix DiG lookup reference counting bug, which could be observed in NSSEARCH mode. [GL #3478] (From OE-Core rev: ed4a32b9c6e25b09a2aa4eb0446bf0ea9ed37ca9) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni (cherry picked from commit 1d87d2652f7f6640dda85e037c580c83f99a8ba8) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.6 -> 9.18.7

2022-10-11T20:56:13+00:00

CVE fixed : -CVE-2022-2795 -CVE-2022-2881 -CVE-2022-2906 -CVE-2022-3080 -CVE-2022-38178 Notes for BIND 9.18.7 [https://downloads.isc.org/isc/bind9/9.18.7/doc/arm/html/notes.html#notes-for-bind-9-18-7] (From OE-Core rev: 5b87b79c6bb155d23ad4eab3243118b98a3b5906) (From OE-Core rev: 01710ddade6cf20a5ddbbf9599843e8753baff51) Signed-off-by: Teoh Jay Shen Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.5 -> 9.18.6

2022-10-11T20:56:13+00:00

(From OE-Core rev: f7061fc14cbc4388b1fd0cf6233b1a2e743e20e5) (From OE-Core rev: daae4cada71b197a353b7f0446d43f98e17bcbaa) Signed-off-by: Wang Mingyu Signed-off-by: Luca Ceresoli Signed-off-by: Richard Purdie Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

bind: upgrade 9.18.4 -> 9.18.5

2022-09-03T12:09:49+00:00

BIND 9.18 is a stable branch, suitable for production use. Notes for BIND 9.18.5 Feature Changes The dnssec-signzone -H default value has been changed to 0 additional NSEC3 iterations. This change aligns the dnssec-signzone default with the default used by the dnssec-policy feature. At the same time, documentation about NSEC3 has been aligned with the Best Current Practice. [GL #3395] Bug Fixes - An assertion failure caused by a TCP connection closing between a connect (or accept) and a read from a socket has been fixed. [GL #3400] - When grafting non-delegated namespace onto delegated namespace, synth-from-dnssec could incorrectly synthesize non-existence of records within the non-delegated namespace using NSEC records from higher zones. [GL #3402] - Previously, named immediately returned a SERVFAIL response to the client when it received a FORMERR response from an authoritative server during recursive resolution. This has been fixed: named acting as a resolver now attempts to contact other authoritative servers for a given domain when it receives a FORMERR response from one of them. [GL #3152] - Previously, rndc reconfig did not pick up changes to endpoints statements in http blocks. This has been fixed. [GL #3415] - It was possible for a catalog zone consumer to process a catalog zone member zone when there was a configured pre-existing forward-only forward zone with the same name. This has been fixed. [GL #2506] (From OE-Core rev: 75c4b8361ef2d3a39e192ed8318d1038a3ff0999) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 0a419b730ca87daa4e07daf022a550fb4112b9b0) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie