diff --git a/CHANGES b/CHANGES index 66fcf12ea0..4e3dc61863 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,5 @@ + --- 9.14.12 released --- + 5395. [security] Further limit the number of queries that can be triggered from a request. Root and TLD servers are no longer exempt from max-recursion-queries. diff --git a/README b/README index bf1ca02193..6193f7e133 100644 --- a/README +++ b/README @@ -200,6 +200,11 @@ BIND 9.14.11 BIND 9.14.11 is a maintenance release. +BIND 9.14.12 + +BIND 9.14.12 is a maintenance release, and also addresses the security +vulnerabilities disclosed in CVE-2020-8616 and CVE-2020-8617. + Building BIND Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler, diff --git a/README.md b/README.md index d8419ad7a7..29e9859687 100644 --- a/README.md +++ b/README.md @@ -217,6 +217,11 @@ BIND 9.14.10 is a maintenance release. BIND 9.14.11 is a maintenance release. +#### BIND 9.14.12 + +BIND 9.14.12 is a maintenance release, and also addresses the security +vulnerabilities disclosed in CVE-2020-8616 and CVE-2020-8617. + ### Building BIND Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler, diff --git a/doc/arm/Bv9ARM.ch01.html b/doc/arm/Bv9ARM.ch01.html index 6c6200765c..09c126688f 100644 --- a/doc/arm/Bv9ARM.ch01.html +++ b/doc/arm/Bv9ARM.ch01.html @@ -614,6 +614,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch02.html b/doc/arm/Bv9ARM.ch02.html index d434346b95..44df142493 100644 --- a/doc/arm/Bv9ARM.ch02.html +++ b/doc/arm/Bv9ARM.ch02.html @@ -146,6 +146,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch03.html b/doc/arm/Bv9ARM.ch03.html index 26071b1215..e091adb9ec 100644 --- a/doc/arm/Bv9ARM.ch03.html +++ b/doc/arm/Bv9ARM.ch03.html @@ -856,6 +856,6 @@ controls { -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch04.html b/doc/arm/Bv9ARM.ch04.html index 0b13d02a6f..ff605d1fbb 100644 --- a/doc/arm/Bv9ARM.ch04.html +++ b/doc/arm/Bv9ARM.ch04.html @@ -2863,6 +2863,6 @@ $ORIGIN 0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch05.html b/doc/arm/Bv9ARM.ch05.html index 280d60aec0..be30e0e1ae 100644 --- a/doc/arm/Bv9ARM.ch05.html +++ b/doc/arm/Bv9ARM.ch05.html @@ -7173,10 +7173,7 @@ avoid-v6-udp-ports { 40000; range 50000 60000; }; Sets the maximum number of iterative queries that may be sent while servicing a recursive query. If more queries are sent, the recursive query - is terminated and returns SERVFAIL. Queries to - look up top level domains such as "com" and "net" - and the DNS root zone are exempt from this limitation. - The default is 75. + is terminated and returns SERVFAIL. The default is 75.

notify-delay
@@ -14955,6 +14952,6 @@ HOST-127.EXAMPLE. MX 0 . -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch06.html b/doc/arm/Bv9ARM.ch06.html index 80d95ddf76..05729c2fd8 100644 --- a/doc/arm/Bv9ARM.ch06.html +++ b/doc/arm/Bv9ARM.ch06.html @@ -362,6 +362,6 @@ allow-query { !{ !10/8; any; }; key example; }; -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch07.html b/doc/arm/Bv9ARM.ch07.html index e187c4b682..c335aba615 100644 --- a/doc/arm/Bv9ARM.ch07.html +++ b/doc/arm/Bv9ARM.ch07.html @@ -191,6 +191,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html index 32415f96bb..ec7cf958fc 100644 --- a/doc/arm/Bv9ARM.ch08.html +++ b/doc/arm/Bv9ARM.ch08.html @@ -36,12 +36,13 @@

Table of Contents

-
Release Notes for BIND Version 9.14.11
+
Release Notes for BIND Version 9.14.12
Introduction
Note on Version Numbering
Supported Platforms
Download
+
Notes for BIND 9.14.12
Notes for BIND 9.14.11
Notes for BIND 9.14.10
Notes for BIND 9.14.9
@@ -62,7 +63,7 @@

-Release Notes for BIND Version 9.14.11

+Release Notes for BIND Version 9.14.12

@@ -96,7 +97,7 @@ cleanup, and some very old code has been removed that supported obsolete operating systems and operating systems for which ISC is no longer able to perform quality assurance testing. Specifically, - workarounds for UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster + workarounds for UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster, and IRIX have been removed.

@@ -109,7 +110,7 @@ More information can be found in the PLATFORM.md file that is included in the source distribution of BIND 9. If your platform compiler and system libraries provide the above features, - BIND 9 should compile and run. If that isn't the case, the BIND + BIND 9 should compile and run. If that is not the case, the BIND development team will generally accept patches that add support for systems that are still supported by their respective vendors.

@@ -137,6 +138,54 @@

+Notes for BIND 9.14.12

+ +
+

+Security Fixes

+
    +
  • +

    + To prevent exhaustion of server resources by a maliciously configured + domain, the number of recursive queries that can be triggered by a + request before aborting recursion has been further limited. Root and + top-level domain servers are no longer exempt from the + max-recursion-queries limit. Fetches for missing + name server address records are limited to 4 for any domain. This + issue was disclosed in CVE-2020-8616. [GL #1388] +

    +
  • +
  • +

    + Replaying a TSIG BADTIME response as a request could + trigger an assertion failure. This was disclosed in + CVE-2020-8617. [GL #1703] +

    +
  • +
  • +

    + DNS rebinding protection was ineffective when BIND 9 was configured + as a forwarding DNS server. Found and responsibly reported by Tobias + Klein. [GL #1574] +

    +
  • +
+
+ +
+

+Bug Fixes

+
  • +

    + Fixed re-signing issues with inline zones which resulted in + records being re-signed late or not at all. +

    +
+
+ +
+
+

Notes for BIND 9.14.11

@@ -1057,8 +1106,9 @@

End of Life

- The end of life date for BIND 9.14 has not yet been determined. - For those needing long term support, the current Extended Support + BIND 9.16 has replaced 9.14 as the current stable version. + This BIND release is the last one in the BIND 9.14 release train. + For those needing long-term support, the current Extended Support Version (ESV) is BIND 9.11, which will be supported until at least December 2021. See https://kb.isc.org/docs/aa-00896 @@ -1092,6 +1142,6 @@

-

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch09.html b/doc/arm/Bv9ARM.ch09.html index 5a7533c312..22d16cce6c 100644 --- a/doc/arm/Bv9ARM.ch09.html +++ b/doc/arm/Bv9ARM.ch09.html @@ -148,6 +148,6 @@
-

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch10.html b/doc/arm/Bv9ARM.ch10.html index 90e942b3dd..b98bbee09f 100644 --- a/doc/arm/Bv9ARM.ch10.html +++ b/doc/arm/Bv9ARM.ch10.html @@ -914,6 +914,6 @@

-

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch11.html b/doc/arm/Bv9ARM.ch11.html index 7610e9f77e..33459d95bc 100644 --- a/doc/arm/Bv9ARM.ch11.html +++ b/doc/arm/Bv9ARM.ch11.html @@ -533,6 +533,6 @@ $ sample-update -a sample-update -k Kxxx.+nnn+mm
-

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.ch12.html b/doc/arm/Bv9ARM.ch12.html index 26aedd2d88..93dba8be11 100644 --- a/doc/arm/Bv9ARM.ch12.html +++ b/doc/arm/Bv9ARM.ch12.html @@ -210,6 +210,6 @@
-

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.html b/doc/arm/Bv9ARM.html index a282b6ec3e..fdf1ac5bf4 100644 --- a/doc/arm/Bv9ARM.html +++ b/doc/arm/Bv9ARM.html @@ -32,7 +32,7 @@

BIND 9 Administrator Reference Manual

-

BIND Version 9.14.11

+

BIND Version 9.14.12


@@ -242,12 +242,13 @@
A. Release Notes
-
Release Notes for BIND Version 9.14.11
+
Release Notes for BIND Version 9.14.12
Introduction
Note on Version Numbering
Supported Platforms
Download
+
Notes for BIND 9.14.12
Notes for BIND 9.14.11
Notes for BIND 9.14.10
Notes for BIND 9.14.9
@@ -447,6 +448,6 @@
-

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/Bv9ARM.pdf b/doc/arm/Bv9ARM.pdf index 60ce4fefc7..c1a4008c11 100644 Binary files a/doc/arm/Bv9ARM.pdf and b/doc/arm/Bv9ARM.pdf differ diff --git a/doc/arm/man.arpaname.html b/doc/arm/man.arpaname.html index ca364ad998..e4a06ca353 100644 --- a/doc/arm/man.arpaname.html +++ b/doc/arm/man.arpaname.html @@ -90,6 +90,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.ddns-confgen.html b/doc/arm/man.ddns-confgen.html index 812bf29cd7..e111d158ea 100644 --- a/doc/arm/man.ddns-confgen.html +++ b/doc/arm/man.ddns-confgen.html @@ -220,6 +220,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.delv.html b/doc/arm/man.delv.html index dce4c4c2ae..e24982954d 100644 --- a/doc/arm/man.delv.html +++ b/doc/arm/man.delv.html @@ -625,6 +625,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dig.html b/doc/arm/man.dig.html index 69e4a829f5..edc6a6e16e 100644 --- a/doc/arm/man.dig.html +++ b/doc/arm/man.dig.html @@ -1166,6 +1166,6 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-cds.html b/doc/arm/man.dnssec-cds.html index 1658bf7521..172f20a58c 100644 --- a/doc/arm/man.dnssec-cds.html +++ b/doc/arm/man.dnssec-cds.html @@ -376,6 +376,6 @@ nsupdate -l -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-checkds.html b/doc/arm/man.dnssec-checkds.html index 52affae1b3..0be7fe6f70 100644 --- a/doc/arm/man.dnssec-checkds.html +++ b/doc/arm/man.dnssec-checkds.html @@ -150,6 +150,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-coverage.html b/doc/arm/man.dnssec-coverage.html index 07a43afbb3..2e8d111d44 100644 --- a/doc/arm/man.dnssec-coverage.html +++ b/doc/arm/man.dnssec-coverage.html @@ -270,6 +270,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-dsfromkey.html b/doc/arm/man.dnssec-dsfromkey.html index 8513df662b..b64f5c737e 100644 --- a/doc/arm/man.dnssec-dsfromkey.html +++ b/doc/arm/man.dnssec-dsfromkey.html @@ -352,6 +352,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-importkey.html b/doc/arm/man.dnssec-importkey.html index f2278e9899..71a2b30d47 100644 --- a/doc/arm/man.dnssec-importkey.html +++ b/doc/arm/man.dnssec-importkey.html @@ -250,6 +250,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-keyfromlabel.html b/doc/arm/man.dnssec-keyfromlabel.html index 9d93a4659b..763119c0a3 100644 --- a/doc/arm/man.dnssec-keyfromlabel.html +++ b/doc/arm/man.dnssec-keyfromlabel.html @@ -496,6 +496,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-keygen.html b/doc/arm/man.dnssec-keygen.html index 34fc975fb0..af3bac65b2 100644 --- a/doc/arm/man.dnssec-keygen.html +++ b/doc/arm/man.dnssec-keygen.html @@ -557,6 +557,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-keymgr.html b/doc/arm/man.dnssec-keymgr.html index 8ecda85c87..03b32adfd5 100644 --- a/doc/arm/man.dnssec-keymgr.html +++ b/doc/arm/man.dnssec-keymgr.html @@ -405,6 +405,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-revoke.html b/doc/arm/man.dnssec-revoke.html index dac0ef89d0..7a774643d9 100644 --- a/doc/arm/man.dnssec-revoke.html +++ b/doc/arm/man.dnssec-revoke.html @@ -171,6 +171,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-settime.html b/doc/arm/man.dnssec-settime.html index b62fcd1e10..2c3dad3ba8 100644 --- a/doc/arm/man.dnssec-settime.html +++ b/doc/arm/man.dnssec-settime.html @@ -349,6 +349,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-signzone.html b/doc/arm/man.dnssec-signzone.html index f96a9d447c..bcd4d32235 100644 --- a/doc/arm/man.dnssec-signzone.html +++ b/doc/arm/man.dnssec-signzone.html @@ -701,6 +701,6 @@ db.example.com.signed -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnssec-verify.html b/doc/arm/man.dnssec-verify.html index bbffe67f7b..21d94402cd 100644 --- a/doc/arm/man.dnssec-verify.html +++ b/doc/arm/man.dnssec-verify.html @@ -202,6 +202,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.dnstap-read.html b/doc/arm/man.dnstap-read.html index 9af66b9a11..dc01f8ff63 100644 --- a/doc/arm/man.dnstap-read.html +++ b/doc/arm/man.dnstap-read.html @@ -143,6 +143,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.filter-aaaa.html b/doc/arm/man.filter-aaaa.html index 6562aa99f3..84542dbdf7 100644 --- a/doc/arm/man.filter-aaaa.html +++ b/doc/arm/man.filter-aaaa.html @@ -168,6 +168,6 @@ plugin query "/usr/local/lib/filter-aaaa.so" { -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.host.html b/doc/arm/man.host.html index 716a266d9a..5287ca7110 100644 --- a/doc/arm/man.host.html +++ b/doc/arm/man.host.html @@ -366,6 +366,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.mdig.html b/doc/arm/man.mdig.html index 4042e88603..da8e8c7848 100644 --- a/doc/arm/man.mdig.html +++ b/doc/arm/man.mdig.html @@ -604,6 +604,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named-checkconf.html b/doc/arm/man.named-checkconf.html index 18d07adb9e..883214abd0 100644 --- a/doc/arm/man.named-checkconf.html +++ b/doc/arm/man.named-checkconf.html @@ -208,6 +208,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named-checkzone.html b/doc/arm/man.named-checkzone.html index 2b1ccd0cd1..0b6cc38b03 100644 --- a/doc/arm/man.named-checkzone.html +++ b/doc/arm/man.named-checkzone.html @@ -463,6 +463,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named-journalprint.html b/doc/arm/man.named-journalprint.html index 8b195bd0e9..49e127ef76 100644 --- a/doc/arm/man.named-journalprint.html +++ b/doc/arm/man.named-journalprint.html @@ -117,6 +117,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named-nzd2nzf.html b/doc/arm/man.named-nzd2nzf.html index c6c7e0ea90..3f2780dad8 100644 --- a/doc/arm/man.named-nzd2nzf.html +++ b/doc/arm/man.named-nzd2nzf.html @@ -119,6 +119,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named-rrchecker.html b/doc/arm/man.named-rrchecker.html index 673443c1f7..dd73932625 100644 --- a/doc/arm/man.named-rrchecker.html +++ b/doc/arm/man.named-rrchecker.html @@ -121,6 +121,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named.conf.html b/doc/arm/man.named.conf.html index 64136b19e7..f78b92a3bc 100644 --- a/doc/arm/man.named.conf.html +++ b/doc/arm/man.named.conf.html @@ -1075,6 +1075,6 @@ zone -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.named.html b/doc/arm/man.named.html index 4dfeb5250a..49e3db4326 100644 --- a/doc/arm/man.named.html +++ b/doc/arm/man.named.html @@ -492,6 +492,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.nsec3hash.html b/doc/arm/man.nsec3hash.html index 7c82408dc3..2d6eba3550 100644 --- a/doc/arm/man.nsec3hash.html +++ b/doc/arm/man.nsec3hash.html @@ -155,6 +155,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.nslookup.html b/doc/arm/man.nslookup.html index 9046c27d8a..59982bb8f8 100644 --- a/doc/arm/man.nslookup.html +++ b/doc/arm/man.nslookup.html @@ -443,6 +443,6 @@ nslookup -query=hinfo -timeout=10 -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.nsupdate.html b/doc/arm/man.nsupdate.html index e6147caa7f..8738b4b6cd 100644 --- a/doc/arm/man.nsupdate.html +++ b/doc/arm/man.nsupdate.html @@ -818,6 +818,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.pkcs11-destroy.html b/doc/arm/man.pkcs11-destroy.html index 6c3f9b41e4..766afd6c72 100644 --- a/doc/arm/man.pkcs11-destroy.html +++ b/doc/arm/man.pkcs11-destroy.html @@ -162,6 +162,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.pkcs11-keygen.html b/doc/arm/man.pkcs11-keygen.html index a0c35d64e9..38525b1217 100644 --- a/doc/arm/man.pkcs11-keygen.html +++ b/doc/arm/man.pkcs11-keygen.html @@ -200,6 +200,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.pkcs11-list.html b/doc/arm/man.pkcs11-list.html index 92bd3c23c9..92b946ed82 100644 --- a/doc/arm/man.pkcs11-list.html +++ b/doc/arm/man.pkcs11-list.html @@ -158,6 +158,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.pkcs11-tokens.html b/doc/arm/man.pkcs11-tokens.html index cecdaa46fc..054d45275f 100644 --- a/doc/arm/man.pkcs11-tokens.html +++ b/doc/arm/man.pkcs11-tokens.html @@ -123,6 +123,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.rndc-confgen.html b/doc/arm/man.rndc-confgen.html index 5e2abb9a37..e22596956e 100644 --- a/doc/arm/man.rndc-confgen.html +++ b/doc/arm/man.rndc-confgen.html @@ -260,6 +260,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.rndc.conf.html b/doc/arm/man.rndc.conf.html index e41dc8a2d9..5a16ea9d85 100644 --- a/doc/arm/man.rndc.conf.html +++ b/doc/arm/man.rndc.conf.html @@ -268,6 +268,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/man.rndc.html b/doc/arm/man.rndc.html index 8ae6896463..51ab3216d5 100644 --- a/doc/arm/man.rndc.html +++ b/doc/arm/man.rndc.html @@ -1024,6 +1024,6 @@ -

BIND 9.14.11 (Stable Release)

+

BIND 9.14.12 (Stable Release)

diff --git a/doc/arm/notes-9.14.12.xml b/doc/arm/notes-9.14.12.xml index 42761216b8..f6cc8806de 100644 --- a/doc/arm/notes-9.14.12.xml +++ b/doc/arm/notes-9.14.12.xml @@ -33,8 +33,8 @@ - DNS rebinding protection was ineffective when BIND 9 is configured as - a forwarding DNS server. Found and responsibly reported by Tobias + DNS rebinding protection was ineffective when BIND 9 was configured + as a forwarding DNS server. Found and responsibly reported by Tobias Klein. [GL #1574] diff --git a/doc/arm/notes.html b/doc/arm/notes.html index cb0b4eab28..d9b43ece57 100644 --- a/doc/arm/notes.html +++ b/doc/arm/notes.html @@ -15,7 +15,7 @@

-Release Notes for BIND Version 9.14.11

+Release Notes for BIND Version 9.14.12

@@ -49,7 +49,7 @@ cleanup, and some very old code has been removed that supported obsolete operating systems and operating systems for which ISC is no longer able to perform quality assurance testing. Specifically, - workarounds for UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster + workarounds for UnixWare, BSD/OS, AIX, Tru64, SunOS, TruCluster, and IRIX have been removed.

@@ -62,7 +62,7 @@ More information can be found in the PLATFORM.md file that is included in the source distribution of BIND 9. If your platform compiler and system libraries provide the above features, - BIND 9 should compile and run. If that isn't the case, the BIND + BIND 9 should compile and run. If that is not the case, the BIND development team will generally accept patches that add support for systems that are still supported by their respective vendors.

@@ -90,6 +90,54 @@

+Notes for BIND 9.14.12

+ +
+

+Security Fixes

+
    +
  • +

    + To prevent exhaustion of server resources by a maliciously configured + domain, the number of recursive queries that can be triggered by a + request before aborting recursion has been further limited. Root and + top-level domain servers are no longer exempt from the + max-recursion-queries limit. Fetches for missing + name server address records are limited to 4 for any domain. This + issue was disclosed in CVE-2020-8616. [GL #1388] +

    +
  • +
  • +

    + Replaying a TSIG BADTIME response as a request could + trigger an assertion failure. This was disclosed in + CVE-2020-8617. [GL #1703] +

    +
  • +
  • +

    + DNS rebinding protection was ineffective when BIND 9 was configured + as a forwarding DNS server. Found and responsibly reported by Tobias + Klein. [GL #1574] +

    +
  • +
+
+ +
+

+Bug Fixes

+
  • +

    + Fixed re-signing issues with inline zones which resulted in + records being re-signed late or not at all. +

    +
+
+ +
+
+

Notes for BIND 9.14.11

@@ -1010,8 +1058,9 @@

End of Life

- The end of life date for BIND 9.14 has not yet been determined. - For those needing long term support, the current Extended Support + BIND 9.16 has replaced 9.14 as the current stable version. + This BIND release is the last one in the BIND 9.14 release train. + For those needing long-term support, the current Extended Support Version (ESV) is BIND 9.11, which will be supported until at least December 2021. See https://kb.isc.org/docs/aa-00896 diff --git a/doc/arm/notes.pdf b/doc/arm/notes.pdf index 1cfe96bbaf..b8d2194202 100644 Binary files a/doc/arm/notes.pdf and b/doc/arm/notes.pdf differ diff --git a/doc/arm/notes.txt b/doc/arm/notes.txt index 4a0db5b75e..11b24a05f4 100644 --- a/doc/arm/notes.txt +++ b/doc/arm/notes.txt @@ -1,4 +1,4 @@ -Release Notes for BIND Version 9.14.11 +Release Notes for BIND Version 9.14.12 Introduction @@ -22,7 +22,7 @@ Since 9.12, BIND has undergone substantial code refactoring and cleanup, and some very old code has been removed that supported obsolete operating systems and operating systems for which ISC is no longer able to perform quality assurance testing. Specifically, workarounds for UnixWare, BSD/OS, -AIX, Tru64, SunOS, TruCluster and IRIX have been removed. +AIX, Tru64, SunOS, TruCluster, and IRIX have been removed. On UNIX-like systems, BIND now requires support for POSIX.1c threads (IEEE Std 1003.1c-1995), the Advanced Sockets API for IPv6 (RFC 3542), and @@ -31,7 +31,7 @@ standard atomic operations provided by the C compiler. More information can be found in the PLATFORM.md file that is included in the source distribution of BIND 9. If your platform compiler and system libraries provide the above features, BIND 9 should compile and run. If -that isn't the case, the BIND development team will generally accept +that is not the case, the BIND development team will generally accept patches that add support for systems that are still supported by their respective vendors. @@ -49,6 +49,30 @@ www.isc.org/download/. There you will find additional information about each release, source code, and pre-compiled versions for Microsoft Windows operating systems. +Notes for BIND 9.14.12 + +Security Fixes + + * To prevent exhaustion of server resources by a maliciously configured + domain, the number of recursive queries that can be triggered by a + request before aborting recursion has been further limited. Root and + top-level domain servers are no longer exempt from the + max-recursion-queries limit. Fetches for missing name server address + records are limited to 4 for any domain. This issue was disclosed in + CVE-2020-8616. [GL #1388] + + * Replaying a TSIG BADTIME response as a request could trigger an + assertion failure. This was disclosed in CVE-2020-8617. [GL #1703] + + * DNS rebinding protection was ineffective when BIND 9 was configured as + a forwarding DNS server. Found and responsibly reported by Tobias + Klein. [GL #1574] + +Bug Fixes + + * Fixed re-signing issues with inline zones which resulted in records + being re-signed late or not at all. + Notes for BIND 9.14.11 Bug Fixes @@ -528,11 +552,11 @@ www.isc.org/mission/contact/. End of Life -The end of life date for BIND 9.14 has not yet been determined. For those -needing long term support, the current Extended Support Version (ESV) is -BIND 9.11, which will be supported until at least December 2021. See -https://kb.isc.org/docs/aa-00896 for details of ISC's software support -policy. +BIND 9.16 has replaced 9.14 as the current stable version. This BIND +release is the last one in the BIND 9.14 release train. For those needing +long-term support, the current Extended Support Version (ESV) is BIND +9.11, which will be supported until at least December 2021. See https:// +kb.isc.org/docs/aa-00896 for details of ISC's software support policy. Thank You diff --git a/lib/dns/api b/lib/dns/api index c89fe64939..ece8f2d40e 100644 --- a/lib/dns/api +++ b/lib/dns/api @@ -10,5 +10,5 @@ # 9.12: 1200-1299 # 9.13/9.14: 1300-1499 LIBINTERFACE = 1312 -LIBREVISION = 1 +LIBREVISION = 2 LIBAGE = 0 diff --git a/version b/version index 78f9d4c13b..3eba4cf796 100644 --- a/version +++ b/version @@ -5,7 +5,7 @@ PRODUCT=BIND DESCRIPTION="(Stable Release)" MAJORVER=9 MINORVER=14 -PATCHVER=11 +PATCHVER=12 RELEASETYPE= RELEASEVER= EXTENSIONS=