Package "bind9-utils"

bind9 (1:9.18.50-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream release 9.18.50 (LP: #2126464)
    - Updates:
      + Add support for parsing HHIT and BRID records.
      + Deprecate the "tkey-domain" statement.
      + Deprecate the "tkey-gssapi-credential" statement.
      + Fix CPU spikes and slow queries when cache approaches memory limit.
      + Remove ineffective TCP fallback after repeated UDP timeouts.
      + Fall back to TCP on UDP response with a mismatched query ID.
      + Disable recursion, UPDATE, and NOTIFY for non-IN views.
    - Bug Fixes:
      + Allow glue in delegations with QTYPE=ANY.
      + Fix invalid zone from NSEC3 reconfiguration.
      + Fix invalid NSEC3 opt-out records left in zone.
      + Fix crash when reconfiguring zone update policy during active updates.
      + Fix outgoing zone transfers quota issue.
      + Skip unsupported algorithms when looking for signing key.
      + Prevent spurious SERVFAILs for certain 0-TTL resource records.
      + Add missing DNSSEC information when CD bit is set in query.
      + Fix AMTRELAY type 0 presentation format handling.
      + Fix implementation of BRID, HHIT, and DSYNC record types.
      + Fix crashes triggered by rndc modzone.
      + Fix named crash when processing SIG records in dynamic updates.
      + Fix zone verification of NSEC3 signed zones.
      + Prevent a crash when using both dns64 and filter-aaaa.
      + Fix an assertion failure when processing catalog zones.
      + Prevent malicious DNSSEC zones from exhausting validator CPU.
      + Fix rndc-confgen aborting on large HMAC-SHA-384/512 keys.
      + Prevent crafted queries from degrading RRL performance.
      + Fix allow-query/allow-transfer catalog zone custom properties.
      + Fix a memory leak in catalog zones.
      + Fix suppressed missing-glue check in named-checkzone.
      + Reject record sets too large to serve in DNS.
      + Fix DNS64 owner case after DNAME restart.
      + Clear REDIRECT flag when it is not needed.
  * Remove patches fixed upstream:
    - d/p/CVE-2025-8677.patch
    - d/p/CVE-2025-40778.patch
    - d/p/CVE-2025-40780.patch
    [Fixed in 9.18.41]
    - d/p/CVE-2026-1519-*.patch
    [Fixed in 9.18.47]
    - d/p/CVE-2026-3039-*.patch
    - d/p/CVE-2026-3592-*.patch
    - d/p/CVE-2026-5946-*.patch
    - d/p/CVE-2026-5950-*.patch
    [Fixed in 9.18.49]
  * d/p/CVE-2026-11721-3.patch, d/p/CVE-2026-19666-1.patch,
    d/p/CVE-2026-19662-pre1.patch, d/p/CVE-2026-19033.patch: Refresh for new
    version.
  * d/p/amtrelay-allow-missing-type0-placeholder.patch: Keep accepting
    AMTRELAY type 0 records without the "." gateway placeholder to avoid
    zones failing to load after upgrade.
  * d/e/apparmor.d/usr.sbin.named: Allow read access to
    /proc/version_signature for named (LP: #2119320).

 -- Lena Voytek Wed, 14 Oct 2026 14:48:53 -0400

  bind9 (1:9.18.39-0ubuntu0.24.04.4) noble; urgency=medium

  * d/e/apparmor.d/usr.sbin.named: Allow read access to
    /proc/version_signature for named (LP: #2119320).

 -- Luciano Lo Giudice <email address hidden> Fri, 27 Mar 2026 18:02:30 -0300

  bind9 (1:9.18.39-0ubuntu0.24.04.1) noble; urgency=medium

  * New upstream release 9.18.39 (LP: #2112520)
    - Features:
      + Add support for parsing the DSYNC record.
      + Add support for the CO flag to dig.
      + Add a new option to configure the maximum number of outgoing queries
        per client request.
      + Add WALLET type.
    - Updates:
      + Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1 and DS digest type 1.
      + Make TLS data processing more reliable in various network conditions.
      + Print the expiration time of the stale records.
      + Remove –with-tuning=small/large configuration option.
      + Update built-in bind.keys file with the new 2025 IANA root key.
      + Move contributed DLZ modules into a separate repository.
      + Emit more helpful log messages for exceeding max-records-per-type.
      + Harden key management when key files have become unavailable.
      + Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS.
    - Bug Fixes:
      + Fix a possible crash when adding a zone while recursing.
      + Clean enough memory when adding new ADB names/entries under memory pressure.
      + Prevent spurious validation failures.
      + Rescan the interfaces again when reconfiguring the server.
      + Fix the default interface-interval from 60s to 60m.
      + Fix purge-keys bug when using views.
      + Set name for all the isc_mem contexts.
      + Stop caching lack of EDNS support.
      + Fix resolver statistics counters for timed-out responses.
      + Don’t enforce NOAUTH/NOCONF flags in DNSKEYs.
      + Fix inconsistency in CNAME/DNAME handling during resolution.
      + Fix deferred validation of unsigned DS and DNSKEY records.
      + Fix RPZ race condition during a reconfiguration.
      + Fix “CNAME and other data check” not being applied to all types.
      + Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
      + Fix rndc flushname for longer name server names.
      + Fix recently expired records sending timestamps in the future.
      + Fix YAML string not terminated in negative response in delv.
      + Apply the memory limit only to ADB database items.
      + Avoid unnecessary locking in the zone/cache database.
      + Improve the resolver performance under attack.
      + Fix nsupdate hang when processing a large update.
      + Fix possible assertion failure when reloading server while processing
        update policy rules.
      + Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys.
      + Fix improper handling of unknown directives in resolv.conf.
      + Fix dig parsing of {&dns}.
      + Fix NSEC3 closest encloser lookup for names with empty non-terminals.
      + Fix display of dig options with format form [+-]option=<value>.
      + Provide more visibility into TLS configuration errors by logging
      + Fix a statistics channel counter bug when “forward only” zones are
        used.
      + Fix wrong address queries in the static-stub implementation.
      + Limit the outgoing UDP send queue size.
      + Do not set SO_INCOMING_CPU.
    - See https://bind9.readthedocs.io/en/v9.18.39/notes.html for additional
      information.
  * d/p/CVE-2024-11187.patch, d/p/CVE-2024-12705.patch - Remove - fixed
    upstream in 9.18.33.
  * d/p/0002-Add-support-for-reporting-status-via-sd_notify.patch: Refresh for
    new version.
  * d/bind9.postinst: Perform postinst config check. (LP: #1492212)
  * Clean up terminal after SIGINT call in interactive tools. (LP: #2112278)
    - d/p/add-sigint-on-interactive-cleanup.patch: Run rl_reset_terminal before
      SIGINT exit.
    - d/rules: Link with libedit to use readline command in base library.

 -- Lena Voytek <email address hidden> Thu, 21 Aug 2025 10:46:13 -0400