1 .. Copyright (C) Internet Systems Consortium, Inc. ("ISC") 2 .. 3 .. SPDX-License-Identifier: MPL-2.0 4 .. 5 .. This Source Code Form is subject to the terms of the Mozilla Public 6 .. License, v. 2.0. If a copy of the MPL was not distributed with this 7 .. file, you can obtain one at https://mozilla.org/MPL/2.0/. 8 .. 9 .. See the COPYRIGHT file distributed with this work for additional 10 .. information regarding copyright ownership. 11 12 BIND 9.20.18 13 ------------ 14 15 Security Fixes 16 ~~~~~~~~~~~~~~ 17 18 - [CVE-2025-13878] Fix incorrect length checks for BRID and HHIT 19 records. ``d4c0d61701`` 20 21 Malformed BRID and HHIT records could trigger an assertion failure. 22 This has been fixed. 23 24 ISC would like to thank Vlatko Kosturjak from Marlink Cyber for 25 bringing this vulnerability to our attention. :gl:`#5616` 26 27 Feature Changes 28 ~~~~~~~~~~~~~~~ 29 30 - Support compilation with cmocka 2.0.0+ ``bb9234c6ce`` 31 32 The `assert_in_range()` function was deprecated in favor of 33 `assert_int_in_range()` and `assert_uint_in_range()`. Add 34 compatibility shims for cmocka<2.0.0 and use the new functions. 35 :gl:`#5699` :gl:`!11437` 36 37 - Add more information to the rndc recursing output about fetches. 38 ``9766feb4df`` 39 40 This adds more information about the active fetches for debugging and 41 diagnostic purposes. :gl:`!11358` 42 43 Bug Fixes 44 ~~~~~~~~~ 45 46 - Make key rollovers more robust. ``7a70d05b5d`` 47 48 A manual rollover when the zone is in an invalid DNSSEC state causes 49 predecessor keys to be removed too quickly. Additional safeguards to 50 prevent this have been added. DNSSEC records will not be removed from 51 the zone until the underlying state machine has moved back into a 52 valid DNSSEC state. :gl:`#5458` :gl:`!11329` 53 54 - Fix a catalog zones issue when a member zone could fail to load. 55 ``95cbc2c327`` 56 57 A catalog zone's member zone could fail to load in some rare cases, 58 when the internally generated zone configuration string was exceeding 59 512 bytes. That condition only was not enough for the issue to arise, 60 but it was a necessary condition. This could happen, for example, if 61 the catalog zone's default primary servers list contained a large 62 number of items. This has been fixed. :gl:`#5658` :gl:`!11349` 63 64 - Allow glue in delegations with QTYPE=ANY. ``441158ac18`` 65 66 When a query for type ANY triggered a delegation response, all 67 additional data was omitted from the response, including mandatory 68 glue. This has been corrected. :gl:`#5659` :gl:`!11283` 69 70 - Adding NSEC3 opt-out records could leave invalid records in chain. 71 ``1b90296e1f`` 72 73 When creating an NSEC3 opt-out chain, a node in the chain could be 74 removed too soon, causing the previous NSEC3 being unable to be found, 75 resulting in invalid NSEC3 records to be left in the zone. This has 76 been fixed. :gl:`#5671` :gl:`!11340` 77 78 - Fix slow speed of NSEC3 optout large delegation zone signing. 79 ``88f915b77b`` 80 81 BIND 9.20 takes much more time signing a large delegation zone with 82 NSEC3 optout compared to version 9.18. This has been restored. 83 :gl:`#5672` :gl:`!11362` 84 85 - Reconfigure NSEC3 opt-out zone to NSEC causes zone to be invalid. 86 ``1d0e19c612`` 87 88 A zone that is signed with NSEC3, opt-out enabled, and then 89 reconfigured to use NSEC, causes the zone to be published with missing 90 NSEC records. This has been fixed. :gl:`#5679` :gl:`!11401` 91 92 - Fix a possible catalog zone issue during reconfiguration. 93 ``911b45b2b3`` 94 95 The :iscman:`named` process could terminate unexpectedly during 96 reconfiguration when a catalog zone update was taking place at the 97 same time. This has been fixed. :gl:`!11386` 98 99 - Fix the charts in the statistics channel. ``7c7b01dd65`` 100 101 The charts in the statistics channel could sometimes fail to render in 102 the browser, and were completely disabled for Mozilla-based browsers 103 for historical reasons. This has been fixed. :gl:`!11364` 104 105 106
Indexes created Sun Apr 19 00:22:55 UTC 2026