diff --git a/CHANGES b/CHANGES index 048bec16e1..372c422c7e 100644 --- a/CHANGES +++ b/CHANGES @@ -1,11 +1,12 @@ -5631. [bug] Update ZONEMD to match RFC 8976. [GL #2658] +5631. [protocol] Update the implementation of the ZONEMD RR type to match + RFC 8976. [GL #2658] -5630. [func] Treat DNSSEC responses with NSEC3 iterations greater - than 150 as insecure. [GL #2445] +5630. [func] Treat DNSSEC responses containing NSEC3 records with + iteration counts greater than 150 as insecure. + [GL #2445] -5629. [func] Reduce the supported maximum number of iterations - that can be configured in an NSEC3 zone to 150. - [GL #2642] +5629. [func] Reduce the maximum supported number of NSEC3 iterations + that can be configured for a zone to 150. [GL #2642] --- 9.11.31 released --- diff --git a/doc/arm/notes-9.11.32.xml b/doc/arm/notes-9.11.32.xml index 00a6941073..06b8fefecc 100644 --- a/doc/arm/notes-9.11.32.xml +++ b/doc/arm/notes-9.11.32.xml @@ -11,68 +11,24 @@
Notes for BIND 9.11.32 -
Security Fixes - - - - None. - - - -
- -
Known Issues - - - - None. - - - -
- -
New Features - - - - None. - - - -
- -
Removed Features - - - - None. - - - -
-
Feature Changes - Reduce the supported maximum number of iterations that can be - configured in an NSEC3 zones to 150. [GL #2642] + DNSSEC responses containing NSEC3 records with iteration counts + greater than 150 are now treated as insecure. [GL #2445] - Treat DNSSEC responses with NSEC3 iterations greater than 150 as - insecure. [GL #2445] + The maximum supported number of NSEC3 iterations that can be + configured for a zone has been reduced to 150. [GL #2642] - -
- -
Bug Fixes - - Update ZONEMD to match RFC 8976. [GL #2658] + The implementation of the ZONEMD RR type has been updated to match RFC + 8976. [GL #2658]