|
bind9 (1:9.20.24-1ubuntu3.1) stonking-security; urgency=medium
* SECURITY UPDATE: Excessive memory usage via repeated SOA, CNAME, or DNAME
records
- debian/patches/CVE-2026-75029-1.patch: Skip duplicate singleton records in
lib/dns/message.c.
- debian/patches/CVE-2026-75029-2.patch: Add a unit test for repeated
singleton records in a message in tests/dns/Makefile.am,
tests/dns/message_test.c.
- CVE-2026-75029
* SECURITY UPDATE: Unexpected exit via use-after-free with cached DNSSEC
proofs
- debian/patches/CVE-2026-19662-pre1.patch: Remove unused closest encloser
proof caching in lib/dns/include/dns/rdatalist.h,
lib/dns/include/dns/rdataset.h, lib/dns/include/dns/rdataslab.h,
lib/dns/qpcache.c, lib/dns/qpzone.c, lib/dns/rbtdb.c, lib/dns/rdatalist.c,
lib/dns/rdataset.c, lib/dns/rdataslab.c, lib/dns/resolver.c,
lib/ns/query.c.
- debian/patches/CVE-2026-19662-1.patch: Keep NOQNAME proof slabheaders
alive in lib/dns/include/dns/rdataset.h, lib/dns/rdataslab.c.
- debian/patches/CVE-2026-19662-2.patch: Test NOQNAME proof slabheader
lifetime in tests/dns/qpdb_test.c.
- CVE-2026-19662
* SECURITY UPDATE: Excessive CPU usage validating crafted DNSSEC responses
- debian/patches/CVE-2026-19668-2.patch: Make the exhausted DNSSEC
validation quota terminal in lib/dns/resolver.c, lib/dns/validator.c.
- debian/patches/CVE-2026-19668-3.patch: Bound the DS-to-DNSKEY matching
during DNSSEC validation in lib/dns/include/dns/validator.h,
lib/dns/validator.c.
- CVE-2026-19668
* SECURITY UPDATE: Unexpected exit with DNS64 and malformed answers
- debian/patches/CVE-2026-19666-1.patch: Clear the noqname alias on the
DNS64 filter64 path in lib/ns/query.c.
- debian/patches/CVE-2026-19666-2.patch: Test the DNS64 filter64 path
against a cached NOQNAME proof in bin/tests/system/dns64/ns1/example.db,
bin/tests/system/dns64/ns2/named.conf.j2, bin/tests/system/dns64/tests.sh.
- CVE-2026-19666
* SECURITY UPDATE: Unexpected exit via TKEY query without global options
- debian/patches/CVE-2026-76163-1.patch: Always create the TKEY context in
bin/named/include/named/tkeyconf.h, bin/named/server.c,
bin/named/tkeyconf.c.
- debian/patches/CVE-2026-76163-2.patch: Test TKEY queries without global
options in bin/tests/system/tkey/nooptions/example.db,
bin/tests/system/tkey/nooptions/named.conf,
bin/tests/system/tkey/tests_no_options.py.
- CVE-2026-76163
* SECURITY UPDATE: Zone transfer data used before TSIG verification
- debian/patches/CVE-2026-19033.patch: Remove support for sparse TSIG in
bin/tests/system/xfer/ans5/ans.py, lib/dns/xfrin.c.
- CVE-2026-19033
* SECURITY UPDATE: Forged NXDOMAIN via inapplicable NSEC wildcard proof
- debian/patches/CVE-2026-19941-1.patch: Require NSEC wildcard proofs from
the same zone in lib/dns/include/dns/validator.h, lib/dns/validator.c.
- debian/patches/CVE-2026-19941-2.patch: Test rejection of cross-zone NSEC
wildcard proofs in bin/tests/system/Makefile.am,
bin/tests/system/nsec_wildcard_wrong_zone/ans1/ans.py,
bin/tests/system/nsec_wildcard_wrong_zone/ns2/named.conf.j2, bin/tests/sys
tem/nsec_wildcard_wrong_zone/tests_nsec_wildcard_wrong_zone.py.
- CVE-2026-19941
* SECURITY UPDATE: Unexpected exit via SIG(0) over DNS-over-HTTPS
- debian/patches/CVE-2026-77692-1.patch: Fix an unauthenticated crash on
HTTPS using SIG(0) in lib/isc/netmgr/http.c, lib/isc/netmgr/netmgr-int.h,
lib/isc/netmgr/netmgr.c.
- debian/patches/CVE-2026-77692-2.patch: Test sending SIG(0)/DoH message and
cut connection in bin/tests/system/sig0_https/ns1/named.conf.j2,
bin/tests/system/sig0_https/tests_sig0_https.py.
- CVE-2026-77692
* SECURITY UPDATE: Out-of-zone records served as authoritative
- debian/patches/CVE-2026-78301-1.patch: Test that nodes above the zone apex
are not zone cuts in bin/tests/system/outofzone_zonecut/ns1/attacker.db,
bin/tests/system/outofzone_zonecut/ns1/example.db,
bin/tests/system/outofzone_zonecut/ns1/named.conf.j2,
bin/tests/system/outofzone_zonecut/ns1/root.db,
bin/tests/system/outofzone_zonecut/ns2/dnamezone.db,
bin/tests/system/outofzone_zonecut/ns2/named.conf.j2,
bin/tests/system/outofzone_zonecut/ns2/nszone.db,
bin/tests/system/outofzone_zonecut/ns3/dnamezone.db,
bin/tests/system/outofzone_zonecut/ns3/named.conf.j2,
bin/tests/system/outofzone_zonecut/ns3/nszone.db,
bin/tests/system/outofzone_zonecut/tests_outofzone_zonecut.py.
- debian/patches/CVE-2026-78301-2.patch: Ignore nodes above the zone origin
in zone database lookups in lib/dns/qpzone.c, tests/dns/qpzone_test.c.
- debian/patches/CVE-2026-78301-3.patch: Ignore nodes above the zone origin
in RBT zone database lookups in lib/dns/rbt-zonedb.c.
- CVE-2026-78301
* SECURITY UPDATE: Resource exhaustion via HTTPS/SVCB AliasMode records
- debian/patches/CVE-2026-81563-1.patch: Add a system test for HTTPS
AliasMode additional-data errors in
bin/tests/system/additional/ns1/https.db,
bin/tests/system/additional/ns1/named.conf.j2,
bin/tests/system/additional/ns2/root.db,
bin/tests/system/additional/tests_https_alias.py.
- debian/patches/CVE-2026-81563-2.patch: Release the rdataset when SVCB
additional-data lookups fail in lib/dns/rdata/in_1/svcb_64.c.
- CVE-2026-81563
* SECURITY UPDATE: DNSSEC downgrade via NSEC3 from an unrelated sibling zone
- debian/patches/CVE-2026-77119-2.patch: Reject out-of-zone NSEC3 in the
insecure-referral proof in lib/dns/validator.c.
- CVE-2026-77119
* SECURITY UPDATE: Unexpected exit on wildcard answers with NSEC and NSEC3
proofs
- debian/patches/CVE-2026-80274-1.patch: Keep NOQNAME proof selection
consistent in lib/dns/include/dns/rdatalist.h
|
| CVE-2026-75029 |
In a query response, an attacker may send `named` multiple copies of a record that should only exist once (such as an SOA record). If the RDATA is th |
| CVE-2026-19662 |
An attacker may be able to cause a `named` resolver to abort. The attack requires inducing the victim resolver to send multiple queries for a DNSSEC- |
| CVE-2026-19668 |
A BIND recursive resolver may experience excessive resource consumption if it encounters large numbers of a particular kind of invalid DNSSEC record. |
| CVE-2026-19666 |
On a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` |
| CVE-2026-76163 |
If BIND is loaded with a "`named.conf`" file that contains no global "`options`" block, an attacker can send a query of QTYPE TKEY which may cause an |
| CVE-2026-19033 |
For a secondary zone with transfers restricted by TSIG, `named` may start to serve the data provided in a zone transfer before the final message with |
| CVE-2026-19941 |
An inapplicable NSEC record may be accepted by a `named` resolver as proof that no wildcard exists, which could allow an attacker at the same or an u |
| CVE-2026-77692 |
An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing t |
| CVE-2026-78301 |
A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a |
| CVE-2026-81563 |
A BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate int |
| CVE-2026-77119 |
A validly signed NSEC3 from an unrelated sibling zone may be accepted as an insecurity proof, downgrading a secure delegation and letting a forged un |
| CVE-2026-80274 |
If a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed |
| CVE-2026-19667 |
If an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negativ |
| CVE-2026-81736 |
If a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend dispropo |
| CVE-2026-19630 |
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A |
| CVE-2026-94300 |
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can |
| CVE-2026-96888 |
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing t |
| CVE-2026-97313 |
A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failu |
|
