From da84b6ea4fb62931b5ca074186e2cb67109ec7ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= Date: Fri, 25 Feb 2022 15:14:10 +0100 Subject: [PATCH] Add CHANGES note for [GL #2950] --- CHANGES | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/CHANGES b/CHANGES index a27d63b1e0..022f76582f 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,11 @@ and the dnssec-policy is rejected if both roles are not present for all algorithms in use. [GL #3142] +5817. [security] The rules for acceptance of records into the cache + have been tightened to prevent the possibility of + poisoning if forwarders send records outside + the configured bailiwick. (CVE-2021-25220) [GL #2950] + 5816. [bug] Make BIND compile with LibreSSL 3.5.0, as it was using not very accurate pre-processor checks for using shims. [GL #3172]