Commit 8e5b7d9d authored by Evan Hunt's avatar Evan Hunt
Browse files

Merge branch 'each-sync-v9_12' into 'v9_12'

synchronize 9.12.4-P1 documentation into v9_12

See merge request !1914
parents aea84ece e1d3cc83
Pipeline #14320 passed with stages
in 1 minute and 1 second
--- 9.12.4-P1 released ---
5200. [security] tcp-clients settings could be exceeded in some cases, 5200. [security] tcp-clients settings could be exceeded in some cases,
which could lead to exhaustion of file descriptors. which could lead to exhaustion of file descriptors.
(CVE-2018-5743) [GL #615] (CVE-2018-5743) [GL #615]
......
...@@ -157,6 +157,11 @@ BIND 9.12.4 is a maintenance release, and addresses the security ...@@ -157,6 +157,11 @@ BIND 9.12.4 is a maintenance release, and addresses the security
vulnerabilities disclosed in CVE-2018-5744, CVE-2018-5745, and vulnerabilities disclosed in CVE-2018-5744, CVE-2018-5745, and
CVE-2019-6465. CVE-2019-6465.
BIND 9.12.4-P1
BIND 9.12.4-P1 addresses the security vulnerabilities disclosed in
CVE-2018-5743 and CVE-2019-6467.
Building BIND Building BIND
BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
......
...@@ -175,6 +175,11 @@ BIND 9.12.4 is a maintenance release, and addresses the security ...@@ -175,6 +175,11 @@ BIND 9.12.4 is a maintenance release, and addresses the security
vulnerabilities disclosed in CVE-2018-5744, CVE-2018-5745, and vulnerabilities disclosed in CVE-2018-5744, CVE-2018-5745, and
CVE-2019-6465. CVE-2019-6465.
#### BIND 9.12.4-P1
BIND 9.12.4-P1 addresses the security vulnerabilities disclosed in
CVE-2018-5743 and CVE-2019-6467.
### <a name="build"/> Building BIND ### <a name="build"/> Building BIND
BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
......
...@@ -614,6 +614,6 @@ ...@@ -614,6 +614,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -146,6 +146,6 @@ ...@@ -146,6 +146,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -759,6 +759,6 @@ controls { ...@@ -759,6 +759,6 @@ controls {
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -2867,6 +2867,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. ...@@ -2867,6 +2867,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -6416,7 +6416,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; ...@@ -6416,7 +6416,8 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
<p> <p>
The number of file descriptors reserved for TCP, stdio, The number of file descriptors reserved for TCP, stdio,
etc. This needs to be big enough to cover the number of etc. This needs to be big enough to cover the number of
interfaces <span class="command"><strong>named</strong></span> listens on, <span class="command"><strong>tcp-clients</strong></span> as well as interfaces <span class="command"><strong>named</strong></span> listens on plus
<span class="command"><strong>tcp-clients</strong></span>, as well as
to provide room for outgoing TCP queries and incoming zone to provide room for outgoing TCP queries and incoming zone
transfers. The default is <code class="literal">512</code>. transfers. The default is <code class="literal">512</code>.
The minimum value is <code class="literal">128</code> and the The minimum value is <code class="literal">128</code> and the
...@@ -14803,6 +14804,6 @@ HOST-127.EXAMPLE. MX 0 . ...@@ -14803,6 +14804,6 @@ HOST-127.EXAMPLE. MX 0 .
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -399,6 +399,6 @@ allow-query { !{ !10/8; any; }; key example; }; ...@@ -399,6 +399,6 @@ allow-query { !{ !10/8; any; }; key example; };
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -136,6 +136,6 @@ ...@@ -136,6 +136,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -36,7 +36,7 @@ ...@@ -36,7 +36,7 @@
<div class="toc"> <div class="toc">
<p><b>Table of Contents</b></p> <p><b>Table of Contents</b></p>
<dl class="toc"> <dl class="toc">
<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.4</a></span></dt> <dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.4-P1</a></span></dt>
<dd><dl> <dd><dl>
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt> <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt> <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
...@@ -52,7 +52,7 @@ ...@@ -52,7 +52,7 @@
</div> </div>
<div class="section"> <div class="section">
<div class="titlepage"><div><div><h2 class="title" style="clear: both"> <div class="titlepage"><div><div><h2 class="title" style="clear: both">
<a name="id-1.9.2"></a>Release Notes for BIND Version 9.12.4</h2></div></div></div> <a name="id-1.9.2"></a>Release Notes for BIND Version 9.12.4-P1</h2></div></div></div>
<div class="section"> <div class="section">
<div class="titlepage"><div><div><h3 class="title"> <div class="titlepage"><div><div><h3 class="title">
...@@ -82,76 +82,19 @@ ...@@ -82,76 +82,19 @@
<a name="relnotes_security"></a>Security Fixes</h3></div></div></div> <a name="relnotes_security"></a>Security Fixes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "> <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
<li class="listitem"> <li class="listitem">
<p> <p>
<span class="command"><strong>named</strong></span> could crash during recursive processing In certain configurations, <span class="command"><strong>named</strong></span> could crash
of DNAME records when <span class="command"><strong>deny-answer-aliases</strong></span> was with an assertion failure if <span class="command"><strong>nxdomain-redirect</strong></span>
in use. This flaw is disclosed in CVE-2018-5740. [GL #387] was in use and a redirected query resulted in an NXDOMAIN from the
</p> cache. This flaw is disclosed in CVE-2019-6467. [GL #880]
</li>
<li class="listitem">
<p>
When recursion is enabled but the <span class="command"><strong>allow-recursion</strong></span>
and <span class="command"><strong>allow-query-cache</strong></span> ACLs are not specified, they
should be limited to local networks, but they were inadvertently set
to match the default <span class="command"><strong>allow-query</strong></span>, thus allowing
remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]
</p>
</li>
<li class="listitem">
<p>
The serve-stale feature could cause an assertion failure in
rbtdb.c even when stale-answer-enable was false. The
simultaneous use of stale cache records and NSEC aggressive
negative caching could trigger a recursion loop in the
<span class="command"><strong>named</strong></span> process. This flaw is disclosed in
CVE-2018-5737. [GL #185]
</p>
</li>
<li class="listitem">
<p>
A bug in zone database reference counting could lead to a crash
when multiple versions of a slave zone were transferred from a
master in close succession. This flaw is disclosed in
CVE-2018-5736. [GL #134]
</p>
</li>
<li class="listitem">
<p>
Code change #4964, intended to prevent double signatures
when deleting an inactive zone DNSKEY in some situations,
introduced a new problem during zone processing in which
some delegation glue RRsets are incorrectly identified
as needing RRSIGs, which are then created for them using
the current active ZSK for the zone. In some, but not all
cases, the newly-signed RRsets are added to the zone's
NSEC/NSEC3 chain, but incompletely -- this can result in
a broken chain, affecting validation of proof of nonexistence
for records in the zone. [GL #771]
</p>
</li>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> could crash if it managed a DNSSEC
security root with <span class="command"><strong>managed-keys</strong></span> and the
authoritative zone rolled the key to an algorithm not supported
by BIND 9. This flaw is disclosed in CVE-2018-5745. [GL #780]
</p> </p>
</li> </li>
<li class="listitem"> <li class="listitem">
<p> <p>
<span class="command"><strong>named</strong></span> leaked memory when processing a The TCP client quota set using the <span class="command"><strong>tcp-clients</strong></span>
request with multiple Key Tag EDNS options present. ISC option could be exceeded in some cases. This could lead to
would like to thank Toshifumi Sakaguchi for bringing this exhaustion of file descriptors. This flaw is disclosed in
to our attention. This flaw is disclosed in CVE-2018-5744. CVE-2018-5743. [GL #615]
[GL #772]
</p>
</li>
<li class="listitem">
<p>
Zone transfer controls for writable DLZ zones were not
effective as the <span class="command"><strong>allowzonexfr</strong></span> method was
not being called for such zones. This flaw is disclosed in
CVE-2019-6465. [GL #790]
</p> </p>
</li> </li>
</ul></div> </ul></div>
...@@ -160,129 +103,31 @@ ...@@ -160,129 +103,31 @@
<div class="section"> <div class="section">
<div class="titlepage"><div><div><h3 class="title"> <div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_features"></a>New Features</h3></div></div></div> <a name="relnotes_features"></a>New Features</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "> <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<li class="listitem">
<p> <p>
<span class="command"><strong>update-policy</strong></span> rules that otherwise ignore the None.
name field now require that it be set to "." to ensure that any
type list present is properly interpreted. Previously, if the
name field was omitted from the rule declaration but a type list
was present, it wouldn't be interpreted as expected.
</p> </p>
</li> </li></ul></div>
<li class="listitem">
<p>
<span class="command"><strong>named</strong></span> now supports the "root key sentinel"
mechanism. This enables validating resolvers to indicate
which trust anchors are configured for the root, so that
information about root key rollover status can be gathered.
To disable this feature, add
<span class="command"><strong>root-key-sentinel no;</strong></span> to
<code class="filename">named.conf</code>. [GL #37]
</p>
</li>
<li class="listitem">
<p>
Add the ability to not return a DNS COOKIE option when one
is present in the request. To prevent a cookie being returned
add <span class="command"><strong>answer-cookie no;</strong></span> to
<code class="filename">named.conf</code>. [GL #173]
</p>
<p>
<span class="command"><strong>answer-cookie no</strong></span> is only intended as a
temporary measure, for use when <span class="command"><strong>named</strong></span>
shares an IP address with other servers that do not yet
support DNS COOKIE. A mismatch between servers on the
same address is not expected to cause operational problems,
but the option to disable COOKIE responses so that all
servers have the same behavior is provided out of an
abundance of caution. DNS COOKIE is an important security
mechanism, and should not be disabled unless absolutely
necessary.
</p>
</li>
<li class="listitem">
<p>
Two new update policy rule types have been added
<span class="command"><strong>krb5-selfsub</strong></span> and <span class="command"><strong>ms-selfsub</strong></span>
which allow machines with Kerberos principals to update
the name space at or below the machine names identified
in the respective principals.
</p>
</li>
<li class="listitem">
<p>
The new configure option <span class="command"><strong>--enable-fips-mode</strong></span>
can be used to make BIND enable and enforce FIPS mode in the
OpenSSL library. When compiled with such option the BIND will
refuse to run if FIPS mode can't be enabled, thus this option
must be only enabled for the systems where FIPS mode is available.
</p>
</li>
</ul></div>
</div> </div>
<div class="section"> <div class="section">
<div class="titlepage"><div><div><h3 class="title"> <div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_changes"></a>Feature Changes</h3></div></div></div> <a name="relnotes_changes"></a>Feature Changes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "> <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<li class="listitem">
<p> <p>
BIND now can be compiled against libidn2 library to add None.
IDNA2008 support. Previously BIND only supported IDNA2003
using (now obsolete) idnkit-1 library.
</p> </p>
</li> </li></ul></div>
<li class="listitem">
<p>
<span class="command"><strong>dig +noidnin</strong></span> can be used to disable IDN
processing on the input domain name, when BIND is compiled
with IDN support.
</p>
</li>
<li class="listitem">
<p>
The <span class="command"><strong>rndc nta</strong></span> command could not differentiate
between views of the same name but different class; this
has been corrected with the addition of a <span class="command"><strong>-class</strong></span>
option. [GL #105]
</p>
</li>
<li class="listitem">
<p>
When compiled with IDN support, the <span class="command"><strong>dig</strong></span> and the
<span class="command"><strong>nslookup</strong></span> commands now disable IDN processing when
the standard output is not a tty (e.g. not used by human). The command
line options +idnin and +idnout need to be used to enable IDN
processing when <span class="command"><strong>dig</strong></span> or <span class="command"><strong>nslookup</strong></span>
is used from the shell scripts.
</p>
</li>
</ul></div>
</div> </div>
<div class="section"> <div class="section">
<div class="titlepage"><div><div><h3 class="title"> <div class="titlepage"><div><div><h3 class="title">
<a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div> <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
<div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "> <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
<li class="listitem">
<p>
When a negative trust anchor was added to multiple views
using <span class="command"><strong>rndc nta</strong></span>, the text returned via
<span class="command"><strong>rndc</strong></span> was incorrectly truncated after the
first line, making it appear that only one NTA had been
added. This has been fixed. [GL #105]
</p>
</li>
<li class="listitem">
<p> <p>
<span class="command"><strong>named</strong></span> now rejects excessively large None.
incremental (IXFR) zone transfers in order to prevent
possible corruption of journal files which could cause
<span class="command"><strong>named</strong></span> to abort when loading zones. [GL #339]
</p> </p>
</li> </li></ul></div>
</ul></div>
</div> </div>
<div class="section"> <div class="section">
...@@ -354,6 +199,6 @@ ...@@ -354,6 +199,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -148,6 +148,6 @@ ...@@ -148,6 +148,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -914,6 +914,6 @@ ...@@ -914,6 +914,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -533,6 +533,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm ...@@ -533,6 +533,6 @@ $ <strong class="userinput"><code>sample-update -a sample-update -k Kxxx.+nnn+mm
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -210,6 +210,6 @@ ...@@ -210,6 +210,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -32,7 +32,7 @@ ...@@ -32,7 +32,7 @@
<div> <div>
<div><h1 class="title"> <div><h1 class="title">
<a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div> <a name="id-1"></a>BIND 9 Administrator Reference Manual</h1></div>
<div><p class="releaseinfo">BIND Version 9.12.4</p></div> <div><p class="releaseinfo">BIND Version 9.12.4-P1</p></div>
<div><p class="copyright">Copyright 2000-2019 Internet Systems Consortium, Inc. ("ISC")</p></div> <div><p class="copyright">Copyright 2000-2019 Internet Systems Consortium, Inc. ("ISC")</p></div>
</div> </div>
<hr> <hr>
...@@ -234,7 +234,7 @@ ...@@ -234,7 +234,7 @@
</dl></dd> </dl></dd>
<dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt> <dt><span class="appendix"><a href="Bv9ARM.ch08.html">A. Release Notes</a></span></dt>
<dd><dl> <dd><dl>
<dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.4</a></span></dt> <dt><span class="section"><a href="Bv9ARM.ch08.html#id-1.9.2">Release Notes for BIND Version 9.12.4-P1</a></span></dt>
<dd><dl> <dd><dl>
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt> <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_intro">Introduction</a></span></dt>
<dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt> <dt><span class="section"><a href="Bv9ARM.ch08.html#relnotes_download">Download</a></span></dt>
...@@ -429,6 +429,6 @@ ...@@ -429,6 +429,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
No preview for this file type
...@@ -90,6 +90,6 @@ ...@@ -90,6 +90,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -235,6 +235,6 @@ ...@@ -235,6 +235,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
...@@ -625,6 +625,6 @@ ...@@ -625,6 +625,6 @@
</tr> </tr>
</table> </table>
</div> </div>
<p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4</p> <p xmlns:db="http://docbook.org/ns/docbook" style="text-align: center;">BIND 9.12.4-P1</p>
</body> </body>
</html> </html>
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment