Navigation:
Browse pkgsrc
(this page)
net bind916
CVSweb ] [ 
Homepage ] [ 
RSS ] [ 
Required by ] [ 
Add to tracker ] 2023-01-26 21:01:44 by Benny Siegert | Files touched by this commit (5) |  |
Log message:
Pullup ticket #6726 - requested by taca
net/bind916: security fix
Revisions pulled up:
- net/bind916/Makefile 1.51-1.52
- net/bind916/builtin.mk 1.2
- net/bind916/distinfo 1.43-1.44
- net/bind916/patches/patch-lib_isc_siphash.c 1.4
- net/bind916/patches/patch-lib_ns_update.c 1.3
---
Module Name: pkgsrc
Committed By: taca
Date: Mon Jan 9 06:48:53 UTC 2023
Modified Files:
pkgsrc/net/bind916: Makefile distinfo
Log message:
net/bind916: update to 9.16.36
9.16.36 (2022-12-21)
Feature Changes
* The auto-dnssec option has been deprecated and will be removed in a future
BIND 9.19.x release. Please migrate to dnssec-policy. [GL #3667]
Bug Fixes
* When a catalog zone was removed from the configuration, in some cases a
dangling pointer could cause the named process to crash. This has been
fixed. [GL #3683]
* When a zone was deleted from a server, a key management object related to
that zone was inadvertently kept in memory and only released upon
shutdown. This could lead to constantly increasing memory use on servers
with a high rate of changes affecting the set of zones being served. This
has been fixed. [GL #3727]
* In certain cases, named waited for the resolution of outstanding recursive
queries to finish before shutting down. This was unintended and has been
fixed. [GL #3183]
* The zone <name>/<class>: final reference detached log message \
was moved
from the INFO log level to the DEBUG(1) log level to prevent the
named-checkzone tool from superfluously logging this message in non-debug
mode. [GL #3707]
---
Module Name: pkgsrc
Committed By: taca
Date: Thu Jan 26 13:32:47 UTC 2023
Modified Files:
pkgsrc/net/bind916: Makefile builtin.mk distinfo
pkgsrc/net/bind916/patches: patch-lib_isc_siphash.c
patch-lib_ns_update.c
Log message:
net/bind916: update to 9.16.37
--- 9.16.37 released ---
6067. [security] Fix serve-stale crash when recursive clients soft quota
is reached. (CVE-2022-3924) [GL #3619]
6066. [security] Handle RRSIG lookups when serve-stale is active.
(CVE-2022-3736) [GL #3622]
6064. [security] An UPDATE message flood could cause named to exhaust all
available memory. This flaw was addressed by adding a
new "update-quota" statement that controls the number of
simultaneous UPDATE messages that can be processed or
forwarded. The default is 100. A stats counter has been
added to record events when the update quota is
exceeded, and the XML and JSON statistics version
numbers have been updated. (CVE-2022-3094) [GL #3523]
6062. [func] The DSCP implementation, which has only been
partly operational since 9.16.0, is now marked as
deprecated. Configuring DSCP values in named.conf
will cause a warning will be logged. [GL #3773]
6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone()
by detaching from the zone manager outside of the write
lock. [GL #3768]
6059. [bug] In some serve stale scenarios, like when following an
expired CNAME record, named could return SERVFAIL if the
previous request wasn't successful. Consider non-stale
data when in serve-stale mode. [GL #3678]
6058. [bug] Prevent named from crashing when "rndc delzone"
attempts to delete a zone added by a catalog zone.
[GL #3745]
6050. [bug] Changes to the RPZ response-policy min-update-interval
and add-soa options now take effect as expected when
named is reconfigured. [GL #3740]
6048. [bug] Fix a log message error in dns_catz_update_from_db(),
where serials with values of 2^31 or larger were logged
incorrectly as negative numbers. [GL #3742]
6045. [cleanup] The list of supported DNSSEC algorithms changed log
level from "warning" to "notice" to match named's other
startup messages. [GL !7217]
6044. [bug] There was an "RSASHA236" typo in a log message.
[GL !7206]
|
New packages: