81 lines
3.0 KiB
XML
81 lines
3.0 KiB
XML
<!--
|
|
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
-
|
|
- This Source Code Form is subject to the terms of the Mozilla Public
|
|
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
- file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
-
|
|
- See the COPYRIGHT file distributed with this work for additional
|
|
- information regarding copyright ownership.
|
|
-->
|
|
|
|
<section xml:id="relnotes-9.11.19"><info><title>Notes for BIND 9.11.19</title></info>
|
|
|
|
<section xml:id="relnotes-9.11.19-security"><info><title>Security Fixes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
To prevent exhaustion of server resources by a maliciously configured
|
|
domain, the number of recursive queries that can be triggered by a
|
|
request before aborting recursion has been further limited. Root and
|
|
top-level domain servers are no longer exempt from the
|
|
<command>max-recursion-queries</command> limit. Fetches for missing
|
|
name server address records are limited to 4 for any domain. This
|
|
issue was disclosed in CVE-2020-8616. [GL #1388]
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
Replaying a TSIG BADTIME response as a request could
|
|
trigger an assertion failure. This was disclosed in
|
|
CVE-2020-8617. [GL #1703]
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xml:id="relnotes-9.11.19-changes"><info><title>Feature Changes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
Message IDs in inbound AXFR transfers are now checked for consistency.
|
|
Log messages are emitted for streams with inconsistent message IDs.
|
|
[GL #1674]
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
<section xml:id="relnotes-9.11.19-bugs"><info><title>Bug Fixes</title></info>
|
|
<itemizedlist>
|
|
<listitem>
|
|
<para>
|
|
When running on a system with support for Linux capabilities,
|
|
<command>named</command> drops root privileges very soon after system
|
|
startup. This was causing a spurious log message, "unable to set
|
|
effective uid to 0: Operation not permitted", which has now been
|
|
silenced. [GL #1042] [GL #1090]
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
When <command>named-checkconf -z</command> was run, it would sometimes
|
|
incorrectly set its exit code. It reflected the status of the last
|
|
view found; if zone-loading errors were found in earlier configured
|
|
views but not in the last one, the exit code indicated success.
|
|
Thanks to Graham Clinch. [GL #1807]
|
|
</para>
|
|
</listitem>
|
|
<listitem>
|
|
<para>
|
|
When built without LMDB support, <command>named</command> failed to
|
|
restart after a zone with a double quote (") in its name was added
|
|
with <command>rndc addzone</command>. Thanks to Alberto Fernández.
|
|
[GL #1695]
|
|
</para>
|
|
</listitem>
|
|
</itemizedlist>
|
|
</section>
|
|
|
|
</section>
|