From 83694be2212ca2d7d1c31aecfa5b75a243168b80 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= Date: Mon, 19 Apr 2021 15:37:02 +0200 Subject: [PATCH] Prepare release notes for BIND 9.11.31 --- doc/arm/Makefile.in | 1 + doc/arm/notes-9.11.30.xml | 64 +++------------------------------ doc/arm/notes-9.11.31.xml | 74 +++++++++++++++++++++++++++++++++++++++ doc/arm/notes.xml | 1 + util/copyrights | 1 + 5 files changed, 82 insertions(+), 59 deletions(-) create mode 100644 doc/arm/notes-9.11.31.xml diff --git a/doc/arm/Makefile.in b/doc/arm/Makefile.in index ae6ebefdfc..69e8425405 100644 --- a/doc/arm/Makefile.in +++ b/doc/arm/Makefile.in @@ -21,6 +21,7 @@ PDFOBJS = Bv9ARM.pdf notes.pdf NOTESXML = notes-download.xml notes-eol.xml notes-intro.xml notes-license.xml \ notes-thankyou.xml \ + notes-9.11.31.xml \ notes-9.11.30.xml \ notes-9.11.29.xml \ notes-9.11.28.xml \ diff --git a/doc/arm/notes-9.11.30.xml b/doc/arm/notes-9.11.30.xml index 1dcf4bb31b..8decf45b0a 100644 --- a/doc/arm/notes-9.11.30.xml +++ b/doc/arm/notes-9.11.30.xml @@ -11,64 +11,10 @@
Notes for BIND 9.11.30 -
Security Fixes - - - - A malformed incoming IXFR transfer could trigger an assertion failure - in named, causing it to quit abnormally. - (CVE-2021-25214) - - - ISC would like to thank Greg Kuechle of SaskTel for bringing this - vulnerability to our attention. [GL #2467] - - - - - named crashed when a DNAME record placed in the - ANSWER section during DNAME chasing turned out to be the final answer - to a client query. (CVE-2021-25215) - - - ISC would like to thank Siva Kakarla for - bringing this vulnerability to our attention. [GL #2540] - - - - - When a server's configuration set the - tkey-gssapi-keytab or - tkey-gssapi-credential option, a specially crafted - GSS-TSIG query could cause a buffer overflow in the ISC implementation - of SPNEGO (a protocol enabling negotiation of the security mechanism - used for GSSAPI authentication). This flaw could be exploited to crash - named binaries compiled for 64-bit platforms, and - could enable remote code execution when named was - compiled for 32-bit platforms. (CVE-2021-25216) - - - This vulnerability was reported to us as ZDI-CAN-13347 by Trend Micro - Zero Day Initiative. [GL #2604] - - - -
- -
Feature Changes - - - - The ISC implementation of SPNEGO was removed from BIND 9 source code. - Instead, BIND 9 now always uses the SPNEGO implementation provided by - the system GSSAPI library when it is built with GSSAPI support. All - major contemporary Kerberos/GSSAPI libraries contain an implementation - of the SPNEGO mechanism. [GL #2607] - - - -
+ + The BIND 9.11.30 release was withdrawn after a backporting bug was + discovered during pre-release testing. ISC would like to acknowledge the + assistance of Natan Segal of Bluecat Networks. +
diff --git a/doc/arm/notes-9.11.31.xml b/doc/arm/notes-9.11.31.xml new file mode 100644 index 0000000000..127b71b6b7 --- /dev/null +++ b/doc/arm/notes-9.11.31.xml @@ -0,0 +1,74 @@ + + +
Notes for BIND 9.11.31 + +
Security Fixes + + + + A malformed incoming IXFR transfer could trigger an assertion failure + in named, causing it to quit abnormally. + (CVE-2021-25214) + + + ISC would like to thank Greg Kuechle of SaskTel for bringing this + vulnerability to our attention. [GL #2467] + + + + + named crashed when a DNAME record placed in the + ANSWER section during DNAME chasing turned out to be the final answer + to a client query. (CVE-2021-25215) + + + ISC would like to thank Siva Kakarla for + bringing this vulnerability to our attention. [GL #2540] + + + + + When a server's configuration set the + tkey-gssapi-keytab or + tkey-gssapi-credential option, a specially crafted + GSS-TSIG query could cause a buffer overflow in the ISC implementation + of SPNEGO (a protocol enabling negotiation of the security mechanism + used for GSSAPI authentication). This flaw could be exploited to crash + named binaries compiled for 64-bit platforms, and + could enable remote code execution when named was + compiled for 32-bit platforms. (CVE-2021-25216) + + + This vulnerability was reported to us as ZDI-CAN-13347 by Trend Micro + Zero Day Initiative. [GL #2604] + + + +
+ +
Feature Changes + + + + The ISC implementation of SPNEGO was removed from BIND 9 source code. + Instead, BIND 9 now always uses the SPNEGO implementation provided by + the system GSSAPI library when it is built with GSSAPI support. All + major contemporary Kerberos/GSSAPI libraries contain an implementation + of the SPNEGO mechanism. [GL #2607] + + + +
+ +
diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml index 4224e0e807..dca4f1f978 100644 --- a/doc/arm/notes.xml +++ b/doc/arm/notes.xml @@ -21,6 +21,7 @@ + diff --git a/util/copyrights b/util/copyrights index 41f02a9559..de6b247059 100644 --- a/util/copyrights +++ b/util/copyrights @@ -3267,6 +3267,7 @@ ./doc/arm/notes-9.11.29.xml SGML 2021 ./doc/arm/notes-9.11.3.xml SGML 2019,2020,2021 ./doc/arm/notes-9.11.30.xml SGML 2021 +./doc/arm/notes-9.11.31.xml SGML 2021 ./doc/arm/notes-9.11.4.xml SGML 2019,2020,2021 ./doc/arm/notes-9.11.5.xml SGML 2019,2020,2021 ./doc/arm/notes-9.11.6.xml SGML 2019,2020,2021