|
bind9 (1:9.20.24-1ubuntu0.5) resolute-security; urgency=medium
* SECURITY UPDATE: Amplified resource exhaustion in inbound message processing
- debian/patches/CVE-2026-19630.patch: Limit how many compression pointers a
message may make us follow in bin/tools/dnstap-read.c,
fuzz/dns_name_fromwire.c, fuzz/dns_qpkey_name.c,
fuzz/dns_rdata_fromwire_text.c, fuzz/old.c, fuzz/old.h,
lib/dns/include/dns/compress.h, lib/dns/include/dns/message.h,
lib/dns/include/dns/name.h, lib/dns/include/dns/rdata.h,
lib/dns/include/dns/types.h, lib/dns/journal.c, lib/dns/master.c,
lib/dns/message.c, lib/dns/name.c, lib/dns/nsec3.c, lib/dns/rdata.c,
lib/dns/rdata/any_255/tsig_250.c, lib/dns/rdata/ch_3/a_1.c,
lib/dns/rdata/generic/afsdb_18.c, lib/dns/rdata/generic/amtrelay_260.c,
lib/dns/rdata/generic/cname_5.c, lib/dns/rdata/generic/dname_39.c,
lib/dns/rdata/generic/dsync_66.c, lib/dns/rdata/generic/hip_55.c,
lib/dns/rdata/generic/ipseckey_45.c, lib/dns/rdata/generic/lp_107.c,
lib/dns/rdata/generic/mb_7.c, lib/dns/rdata/generic/md_3.c,
lib/dns/rdata/generic/mf_4.c, lib/dns/rdata/generic/mg_8.c,
lib/dns/rdata/generic/minfo_14.c, lib/dns/rdata/generic/mr_9.c,
lib/dns/rdata/generic/mx_15.c, lib/dns/rdata/generic/naptr_35.c,
lib/dns/rdata/generic/ns_2.c, lib/dns/rdata/generic/nsec_47.c,
lib/dns/rdata/generic/nxt_30.c, lib/dns/rdata/generic/proforma.c,
lib/dns/rdata/generic/ptr_12.c, lib/dns/rdata/generic/rp_17.c,
lib/dns/rdata/generic/rrsig_46.c, lib/dns/rdata/generic/rt_21.c,
lib/dns/rdata/generic/sig_24.c, lib/dns/rdata/generic/soa_6.c,
lib/dns/rdata/generic/talink_58.c, lib/dns/rdata/generic/tkey_249.c,
lib/dns/rdata/in_1/a6_38.c, lib/dns/rdata/in_1/apl_42.c,
lib/dns/rdata/in_1/kx_36.c, lib/dns/rdata/in_1/nsap-ptr_23.c,
lib/dns/rdata/in_1/px_26.c, lib/dns/rdata/in_1/srv_33.c,
lib/dns/rdata/in_1/svcb_64.c, lib/dns/view.c,
tests/bench/dns_name_fromwire.c, tests/dns/message_test.c,
tests/dns/name_test.c, tests/dns/rdata_test.c.
- CVE-2026-19630
* SECURITY UPDATE: Concurrent GSS-TSIG messages corrupt memory
- debian/patches/CVE-2026-94300.patch: Serialize access to the shared GSS-
TSIG security context in lib/dns/gssapi_link.c.
- CVE-2026-94300
* SECURITY UPDATE: named may terminate unexpectedly when a redirect zone is
used with strict QNAME minimization
- debian/patches/CVE-2026-96888-1.patch: Add a test with qname-minimization
strict and redirect in bin/tests/system/redirect/ns10/named.conf.j2,
bin/tests/system/redirect/ns11/named.conf.j2,
bin/tests/system/redirect/ns11/redirect.db,
bin/tests/system/redirect/ns11/root.hints,
bin/tests/system/redirect/ns9/sign.sh,
bin/tests/system/redirect/tests_redirect_dns64.py,
bin/tests/system/redirect/tests_redirect_qmin.py,
bin/tests/system/redirect/tests_redirect_qminzone.py,
bin/tests/system/redirect/tests_sh_redirect.py.
- debian/patches/CVE-2026-96888-2.patch: Clear AD flag on redirect NXRRSET
in lib/ns/query.c.
- debian/patches/CVE-2026-96888-3.patch: Handle qname-minimization failures
gracefully when redirecting in lib/ns/query.c.
- CVE-2026-96888
* SECURITY UPDATE: Specific RPZ configurations and query patterns may result
in an unexpected exit
- debian/patches/CVE-2026-97313-1.patch: Add a reproducer for CVE-2026-97313
in bin/tests/system/rpzrecurse/ans7/ans.py,
bin/tests/system/rpzrecurse/ns1/root.db,
bin/tests/system/rpzrecurse/ns2/db.nsdname,
bin/tests/system/rpzrecurse/ns2/db.rpzip,
bin/tests/system/rpzrecurse/ns2/named.cve-2026-97313.conf,
bin/tests/system/rpzrecurse/tests.sh.
- debian/patches/CVE-2026-97313-2.patch: Test view and RPZ matching after
UDP client reuse in bin/tests/system/rpzrecurse/ns1/root.db,
bin/tests/system/rpzrecurse/ns8/named.args,
bin/tests/system/rpzrecurse/ns8/named.conf.j2,
bin/tests/system/rpzrecurse/ns8/nonrecursive-policy.db,
bin/tests/system/rpzrecurse/ns8/recursive-policy.db,
bin/tests/system/rpzrecurse/ns8/root.hint,
bin/tests/system/rpzrecurse/tests_client_reuse.py.
- debian/patches/CVE-2026-97313-3.patch: Tighten the conditions of the
'recursionok' flag reset in lib/ns/query.c.
- CVE-2026-97313
-- Marc Deslauriers Fri, 30 Oct 2026 10:53:37 -0500
|
