FEDORA-2023-8e1ddb1fa2
Packages in this update:
bind-9.18.16-1.fc38
bind-dyndb-ldap-11.10-17.fc38
Update description:
Update to BIND 9.18.16
Selected parts from upstream release notes. Visit that for details of bug fixes.
Security Fixes
The overmem cleaning process has been improved, to prevent the cache from significantly exceeding the configured max-cache-size limit. (CVE-2023-2828)
ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval Shavitt from Tel-Aviv University for bringing this vulnerability to our attention. [GL #4055]
A query that prioritizes stale data over lookup triggers a fetch to refresh the stale data in cache. If the fetch is aborted for exceeding the recursion quota, it was possible for named to enter an infinite callback loop and crash due to stack overflow. This has been fixed. (CVE-2023-2911) [GL #4089]
New Features
The system test suite can now be executed with pytest (along with pytest-xdist for parallel execution). [GL #3978]
Removed Features
TKEY mode 2 (Diffie-Hellman Exchanged Keying) is now deprecated, and will be removed in a future release. A warning will be logged when the tkey-dhkey option is used in named.conf. [GL #3905]