From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [PATCH] bind: Update to 9.16.27
Date: Wed, 23 Mar 2022 09:19:47 +0000
Message-ID: <2177AAF5-5543-49BC-8355-F4704411C2B3@ipfire.org>
In-Reply-To: <20220322173203.1633-1-matthias.fischer@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7634784346886480610=="
List-Id: <development.lists.ipfire.org>

--===============7634784346886480610==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Reviewed-by: Michael Tremer <michael.tremer(a)ipfire.org>

> On 22 Mar 2022, at 17:32, Matthias Fischer <matthias.fischer(a)ipfire.org> =
wrote:
>=20
> For details see:
> https://downloads.isc.org/isc/bind9/9.16.27/doc/arm/html/notes.html#notes-f=
or-bind-9-16-27
>=20
> "Security Fixes
>=20
>    The rules for acceptance of records into the cache have been
>    tightened to prevent the possibility of poisoning if forwarders send
>    records outside the configured bailiwick. (CVE-2021-25220)
>=20
>    ISC would like to thank Xiang Li, Baojun Liu, and Chaoyi Lu from
>    Network and Information Security Lab, Tsinghua University, and
>    Changgen Zou from Qi An Xin Group Corp. for bringing this
>    vulnerability to our attention. [GL #2950]
>=20
>    TCP connections with keep-response-order enabled could leave the TCP
>    sockets in the CLOSE_WAIT state when the client did not properly
>    shut down the connection. (CVE-2022-0396) [GL #3112]
>=20
> Feature Changes
>=20
>    DEBUG(1)-level messages were added when starting and ending the BIND
>    9 task-exclusive mode that stops normal DNS operation (e.g. for
>    reconfiguration, interface scans, and other events that require
>    exclusive access to a shared resource). [GL #3137]
>=20
> Bug Fixes
>=20
>    The max-transfer-time-out and max-transfer-idle-out options were not
>    implemented when the BIND 9 networking stack was refactored in 9.16.
>    The missing functionality has been re-implemented and outgoing zone
>    transfers now time out properly when not progressing. [GL #1897]
>=20
>    TCP connections could hang indefinitely if the other party did not
>    read sent data, causing the TCP write buffers to fill. This has been
>    fixed by adding a =E2=80=9Cwrite=E2=80=9D timer. Connections that are hu=
ng while
>    writing now time out after the tcp-idle-timeout period has elapsed.
>    [GL #3132]
>=20
>    The statistics counter representing the current number of clients
>    awaiting recursive resolution results (RecursClients) could
>    be miscalculated in certain resolution scenarios, potentially
>    causing the value of the counter to drop below zero. This has been
>    fixed. [GL #3147]"
>=20
> Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org>
> ---
> config/rootfiles/common/bind | 14 +++++++-------
> lfs/bind                     |  4 ++--
> 2 files changed, 9 insertions(+), 9 deletions(-)
>=20
> diff --git a/config/rootfiles/common/bind b/config/rootfiles/common/bind
> index c0e56854a..df3df4f47 100644
> --- a/config/rootfiles/common/bind
> +++ b/config/rootfiles/common/bind
> @@ -274,24 +274,24 @@ usr/bin/nsupdate
> #usr/include/pk11/site.h
> #usr/include/pkcs11
> #usr/include/pkcs11/pkcs11.h
> -usr/lib/libbind9-9.16.26.so
> +usr/lib/libbind9-9.16.27.so
> #usr/lib/libbind9.la
> #usr/lib/libbind9.so
> -usr/lib/libdns-9.16.26.so
> +usr/lib/libdns-9.16.27.so
> #usr/lib/libdns.la
> #usr/lib/libdns.so
> -usr/lib/libirs-9.16.26.so
> +usr/lib/libirs-9.16.27.so
> #usr/lib/libirs.la
> #usr/lib/libirs.so
> -usr/lib/libisc-9.16.26.so
> +usr/lib/libisc-9.16.27.so
> #usr/lib/libisc.la
> #usr/lib/libisc.so
> -usr/lib/libisccc-9.16.26.so
> +usr/lib/libisccc-9.16.27.so
> #usr/lib/libisccc.la
> #usr/lib/libisccc.so
> -usr/lib/libisccfg-9.16.26.so
> +usr/lib/libisccfg-9.16.27.so
> #usr/lib/libisccfg.la
> #usr/lib/libisccfg.so
> -usr/lib/libns-9.16.26.so
> +usr/lib/libns-9.16.27.so
> #usr/lib/libns.la
> #usr/lib/libns.so
> diff --git a/lfs/bind b/lfs/bind
> index 72c85f5f5..d8970a2af 100644
> --- a/lfs/bind
> +++ b/lfs/bind
> @@ -25,7 +25,7 @@
>=20
> include Config
>=20
> -VER        =3D 9.16.26
> +VER        =3D 9.16.27
>=20
> THISAPP    =3D bind-$(VER)
> DL_FILE    =3D $(THISAPP).tar.xz
> @@ -43,7 +43,7 @@ objects =3D $(DL_FILE)
>=20
> $(DL_FILE) =3D $(DL_FROM)/$(DL_FILE)
>=20
> -$(DL_FILE)_MD5 =3D 799696f44e0d61659fa0efaa3c5fe5d8
> +$(DL_FILE)_MD5 =3D db71eecaf698660da37581c42ce9f904
>=20
> install : $(TARGET)
>=20
> --=20
> 2.25.1
>=20


--===============7634784346886480610==--