Merge branch 'prep-release' into v9_11_30-release

CHANGES

@@ -5,6 +5,8 @@
 			configuration included the "tkey-gssapi-credential"
 			option. This has been fixed. [GL #2634]
 
+	--- 9.11.30 released ---
+
 5617.	[security]	A specially crafted GSS-TSIG query could cause a buffer
 			overflow in the ISC implementation of SPNEGO.
 			(CVE-2021-25216) [GL #2604]

README

@@ -377,6 +377,12 @@ BIND 9.11.29
 
 BIND 9.11.29 is a maintenance release.
 
+BIND 9.11.30
+
+BIND 9.11.30 is a maintenance release, and also addresses the security
+vulnerabilities disclosed in CVE-2021-25214, CVE-2021-25215, and
+CVE-2021-25216.
+
 Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,

README.md

@@ -394,6 +394,12 @@ vulnerability disclosed in CVE-2020-8625.
 
 BIND 9.11.29 is a maintenance release.
 
+#### BIND 9.11.30
+
+BIND 9.11.30 is a maintenance release, and also addresses the security
+vulnerabilities disclosed in CVE-2021-25214, CVE-2021-25215, and
+CVE-2021-25216.
+
 ### <a name="build"/> Building BIND
 
 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,

configure

@@ -978,7 +978,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -1152,7 +1151,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1405,15 +1403,6 @@ do
   | -silent | --silent | --silen | --sile | --sil)
     silent=yes ;;
 
-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
   -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
     ac_prev=sbindir ;;
   -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1551,7 +1540,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
   eval ac_val=\$$ac_var
   # Remove trailing slashes.
@@ -1704,7 +1693,6 @@ Fine tuning of the installation directories:
   --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
   --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
   --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
   --libdir=DIR            object code libraries [EPREFIX/lib]
   --includedir=DIR        C header files [PREFIX/include]
   --oldincludedir=DIR     C header files for non-gcc [/usr/include]

doc/arm/Bv9ARM.ch01.html

@@ -576,6 +576,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch02.html

@@ -144,6 +144,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch03.html

@@ -654,6 +654,6 @@ controls {
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch04.html

@@ -2664,6 +2664,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch05.html

@@ -131,6 +131,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch06.html

@@ -12842,6 +12842,6 @@ HOST-127.EXAMPLE. MX 0 .
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch07.html

@@ -384,6 +384,6 @@ allow-query { !{ !10/8; any; }; key example; };
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch08.html

@@ -125,6 +125,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch09.html

@@ -36,11 +36,12 @@
 <div class="toc">
 <p><b>Table of Contents</b></p>
 <dl class="toc">
-<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.29</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.30</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.30">Notes for BIND 9.11.30</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.29">Notes for BIND 9.11.29</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.28">Notes for BIND 9.11.28</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.27">Notes for BIND 9.11.27</a></span></dt>
@@ -78,7 +79,7 @@
 </div>
 <div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.29</h2></div></div></div>
+<a name="id-1.10.2"></a>Release Notes for BIND Version 9.11.30</h2></div></div></div>
 <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_intro"></a>Introduction</h3></div></div></div>
@@ -134,6 +135,66 @@
 </div>
 <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes-9.11.30"></a>Notes for BIND 9.11.30</h3></div></div></div>
+<div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.11.30-security"></a>Security Fixes</h4></div></div></div>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+<p>
+          A malformed incoming IXFR transfer could trigger an assertion failure
+          in <span class="command"><strong>named</strong></span>, causing it to quit abnormally.
+          (CVE-2021-25214)
+        </p>
+<p>
+          ISC would like to thank Greg Kuechle of SaskTel for bringing this
+          vulnerability to our attention. [GL #2467]
+        </p>
+</li>
+<li class="listitem">
+<p>
+          <span class="command"><strong>named</strong></span> crashed when a DNAME record placed in the
+          ANSWER section during DNAME chasing turned out to be the final answer
+          to a client query. (CVE-2021-25215)
+        </p>
+<p>
+          ISC would like to thank <a class="link" href="https://github.com/sivakesava1" target="_top">Siva Kakarla</a> for
+          bringing this vulnerability to our attention. [GL #2540]
+        </p>
+</li>
+<li class="listitem">
+<p>
+          When a server's configuration set the
+          <span class="command"><strong>tkey-gssapi-keytab</strong></span> or
+          <span class="command"><strong>tkey-gssapi-credential</strong></span> option, a specially crafted
+          GSS-TSIG query could cause a buffer overflow in the ISC implementation
+          of SPNEGO (a protocol enabling negotiation of the security mechanism
+          used for GSSAPI authentication). This flaw could be exploited to crash
+          <span class="command"><strong>named</strong></span> binaries compiled for 64-bit platforms, and
+          could enable remote code execution when <span class="command"><strong>named</strong></span> was
+          compiled for 32-bit platforms. (CVE-2021-25216)
+        </p>
+<p>
+          This vulnerability was reported to us as ZDI-CAN-13347 by Trend Micro
+          Zero Day Initiative. [GL #2604]
+        </p>
+</li>
+</ul></div>
+</div>
+<div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.11.30-changes"></a>Feature Changes</h4></div></div></div>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
+          The ISC implementation of SPNEGO was removed from BIND 9 source code.
+          Instead, BIND 9 now always uses the SPNEGO implementation provided by
+          the system GSSAPI library when it is built with GSSAPI support. All
+          major contemporary Kerberos/GSSAPI libraries contain an implementation
+          of the SPNEGO mechanism. [GL #2607]
+        </p></li></ul></div>
+</div>
+</div>
+<div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes-9.11.29"></a>Notes for BIND 9.11.29</h3></div></div></div>
 <div class="section">
 <div class="titlepage"><div><div><h4 class="title">
@@ -2134,6 +2195,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch10.html

@@ -148,6 +148,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch11.html

@@ -508,6 +508,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch12.html

@@ -473,6 +473,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.ch13.html

@@ -176,6 +176,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/Bv9ARM.html

@@ -32,7 +32,7 @@
 <div>
 <div><h1 class="title">
 <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
-<div><p class="releaseinfo">BIND Version 9.11.29</p></div>
+<div><p class="releaseinfo">BIND Version 9.11.30</p></div>
 <div><p class="copyright">Copyright © 2000-2021 Internet Systems Consortium, Inc. ("ISC")</p></div>
 </div>
 <hr>
@@ -241,11 +241,12 @@
 </dl></dd>
 <dt><span class="appendix"><a href="Bv9ARM.ch09.html">A. Release Notes</a></span></dt>
 <dd><dl>
-<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.29</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#id-1.10.2">Release Notes for BIND Version 9.11.30</a></span></dt>
 <dd><dl>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_intro">Introduction</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_download">Download</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes_license">License Change</a></span></dt>
+<dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.30">Notes for BIND 9.11.30</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.29">Notes for BIND 9.11.29</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.28">Notes for BIND 9.11.28</a></span></dt>
 <dt><span class="section"><a href="Bv9ARM.ch09.html#relnotes-9.11.27">Notes for BIND 9.11.27</a></span></dt>
@@ -440,6 +441,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.arpaname.html

@@ -72,6 +72,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.ddns-confgen.html

@@ -176,6 +176,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.delv.html

@@ -499,6 +499,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dig.html

@@ -919,6 +919,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-checkds.html

@@ -101,6 +101,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-coverage.html

@@ -221,6 +221,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-dsfromkey.html

@@ -239,6 +239,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-importkey.html

@@ -179,6 +179,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-keyfromlabel.html

@@ -381,6 +381,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-keygen.html

@@ -462,6 +462,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-keymgr.html

@@ -328,6 +328,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-revoke.html

@@ -126,6 +126,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-settime.html

@@ -269,6 +269,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-signzone.html

@@ -559,6 +559,6 @@ db.example.com.signed
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnssec-verify.html

@@ -156,6 +156,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.dnstap-read.html

@@ -99,6 +99,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.genrandom.html

@@ -93,6 +93,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.host.html

@@ -292,6 +292,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.isc-hmac-fixup.html

@@ -103,6 +103,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.lwresd.html

@@ -245,6 +245,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.mdig.html

@@ -472,6 +472,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named-checkconf.html

@@ -146,6 +146,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named-checkzone.html

@@ -330,6 +330,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named-journalprint.html

@@ -94,6 +94,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named-nzd2nzf.html

@@ -95,6 +95,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named-rrchecker.html

@@ -96,6 +96,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named.conf.html

@@ -974,6 +974,6 @@ zone
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.named.html

@@ -376,6 +376,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.nsec3hash.html

@@ -98,6 +98,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.nslookup.html

@@ -362,6 +362,6 @@ nslookup -query=hinfo  -timeout=10
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.nsupdate.html

@@ -671,6 +671,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.pkcs11-destroy.html

@@ -116,6 +116,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.pkcs11-keygen.html

@@ -141,6 +141,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.pkcs11-list.html

@@ -114,6 +114,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.pkcs11-tokens.html

@@ -91,6 +91,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.rndc-confgen.html

@@ -216,6 +216,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.rndc.conf.html

@@ -238,6 +238,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/man.rndc.html

@@ -786,6 +786,6 @@
 </tr>
 </table>
 </div>
-<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.29 (Extended Support Version)</p>
+<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.11.30 (Extended Support Version)</p>
 </body>
 </html>

doc/arm/notes.html

@@ -13,7 +13,7 @@
 </head>
 <body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="article"><div class="section">
 <div class="titlepage"><div><div><h2 class="title" style="clear: both">
-<a name="id-1.2"></a>Release Notes for BIND Version 9.11.29</h2></div></div></div>
+<a name="id-1.2"></a>Release Notes for BIND Version 9.11.30</h2></div></div></div>
 <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_intro"></a>Introduction</h3></div></div></div>
@@ -69,6 +69,66 @@
 </div>
 <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
+<a name="relnotes-9.11.30"></a>Notes for BIND 9.11.30</h3></div></div></div>
+<div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.11.30-security"></a>Security Fixes</h4></div></div></div>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+<p>
+          A malformed incoming IXFR transfer could trigger an assertion failure
+          in <span class="command"><strong>named</strong></span>, causing it to quit abnormally.
+          (CVE-2021-25214)
+        </p>
+<p>
+          ISC would like to thank Greg Kuechle of SaskTel for bringing this
+          vulnerability to our attention. [GL #2467]
+        </p>
+</li>
+<li class="listitem">
+<p>
+          <span class="command"><strong>named</strong></span> crashed when a DNAME record placed in the
+          ANSWER section during DNAME chasing turned out to be the final answer
+          to a client query. (CVE-2021-25215)
+        </p>
+<p>
+          ISC would like to thank <a class="link" href="https://github.com/sivakesava1" target="_top">Siva Kakarla</a> for
+          bringing this vulnerability to our attention. [GL #2540]
+        </p>
+</li>
+<li class="listitem">
+<p>
+          When a server's configuration set the
+          <span class="command"><strong>tkey-gssapi-keytab</strong></span> or
+          <span class="command"><strong>tkey-gssapi-credential</strong></span> option, a specially crafted
+          GSS-TSIG query could cause a buffer overflow in the ISC implementation
+          of SPNEGO (a protocol enabling negotiation of the security mechanism
+          used for GSSAPI authentication). This flaw could be exploited to crash
+          <span class="command"><strong>named</strong></span> binaries compiled for 64-bit platforms, and
+          could enable remote code execution when <span class="command"><strong>named</strong></span> was
+          compiled for 32-bit platforms. (CVE-2021-25216)
+        </p>
+<p>
+          This vulnerability was reported to us as ZDI-CAN-13347 by Trend Micro
+          Zero Day Initiative. [GL #2604]
+        </p>
+</li>
+</ul></div>
+</div>
+<div class="section">
+<div class="titlepage"><div><div><h4 class="title">
+<a name="relnotes-9.11.30-changes"></a>Feature Changes</h4></div></div></div>
+<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
+          The ISC implementation of SPNEGO was removed from BIND 9 source code.
+          Instead, BIND 9 now always uses the SPNEGO implementation provided by
+          the system GSSAPI library when it is built with GSSAPI support. All
+          major contemporary Kerberos/GSSAPI libraries contain an implementation
+          of the SPNEGO mechanism. [GL #2607]
+        </p></li></ul></div>
+</div>
+</div>
+<div class="section">
+<div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes-9.11.29"></a>Notes for BIND 9.11.29</h3></div></div></div>
 <div class="section">
 <div class="titlepage"><div><div><h4 class="title">

doc/arm/notes.txt

@@ -1,4 +1,4 @@
-Release Notes for BIND Version 9.11.29
+Release Notes for BIND Version 9.11.30
 
 Introduction
 
@@ -36,6 +36,43 @@ Those unsure whether or not the license change affects their use of BIND,
 or who wish to discuss how to comply with the license may contact ISC at
 https://www.isc.org/mission/contact/.
 
+Notes for BIND 9.11.30
+
+Security Fixes
+
+  • A malformed incoming IXFR transfer could trigger an assertion failure
+    in named, causing it to quit abnormally. (CVE-2021-25214)
+
+    ISC would like to thank Greg Kuechle of SaskTel for bringing this
+    vulnerability to our attention. [GL #2467]
+
+  • named crashed when a DNAME record placed in the ANSWER section during
+    DNAME chasing turned out to be the final answer to a client query.
+    (CVE-2021-25215)
+
+    ISC would like to thank Siva Kakarla for bringing this vulnerability
+    to our attention. [GL #2540]
+
+  • When a server's configuration set the tkey-gssapi-keytab or
+    tkey-gssapi-credential option, a specially crafted GSS-TSIG query
+    could cause a buffer overflow in the ISC implementation of SPNEGO (a
+    protocol enabling negotiation of the security mechanism used for
+    GSSAPI authentication). This flaw could be exploited to crash named
+    binaries compiled for 64-bit platforms, and could enable remote code
+    execution when named was compiled for 32-bit platforms.
+    (CVE-2021-25216)
+
+    This vulnerability was reported to us as ZDI-CAN-13347 by Trend Micro
+    Zero Day Initiative. [GL #2604]
+
+Feature Changes
+
+  • The ISC implementation of SPNEGO was removed from BIND 9 source code.
+    Instead, BIND 9 now always uses the SPNEGO implementation provided by
+    the system GSSAPI library when it is built with GSSAPI support. All
+    major contemporary Kerberos/GSSAPI libraries contain an implementation
+    of the SPNEGO mechanism. [GL #2607]
+
 Notes for BIND 9.11.29
 
 Bug Fixes

lib/dns/api

@@ -8,6 +8,6 @@
 # 9.10-sub: 180-189
 # 9.11: 160-169,1100-1199
 # 9.12: 1200-1299
-LIBINTERFACE = 1113
-LIBREVISION = 2
+LIBINTERFACE = 1114
+LIBREVISION = 0
 LIBAGE = 0

version

@@ -5,7 +5,7 @@ PRODUCT=BIND
 DESCRIPTION="(Extended Support Version)"
 MAJORVER=9
 MINORVER=11
-PATCHVER=29
+PATCHVER=30
 RELEASETYPE=
 RELEASEVER=
 EXTENSIONS=