Bug 912265 – <net-dns/bind-9.16.42: Multiple vulnerabilities

• Status: IN_PROGRESS
• Product: Gentoo Security

[Description Sam James 2023-08-14 08:19:01 UTC]

+       --- 9.16.42 released ---
+
+6192.  [security]      A query that prioritizes stale data over lookup
+                       triggers a fetch to refresh the stale data in cache.
+                       If the fetch is aborted for exceeding the recursion
+                       quota, it was possible for 'named' to enter an infinite
+                       callback loop and crash due to stack overflow. This has
+                       been fixed. (CVE-2023-2911) [GL #4089]
+
+6190.  [security]      Improve the overmem cleaning process to prevent the
+                       cache going over the configured limit. (CVE-2023-2828)
+                       [GL #4055]

[Comment 1 Larry the Git Cow 2023-08-14 08:46:04 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=df536233e33d7e0488461cb3b29048881af96559

commit df536233e33d7e0488461cb3b29048881af96559
Author:     Sam James <[e-mail]>
AuthorDate: 2023-08-14 08:34:14 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-08-14 08:34:14 +0000

    net-dns/bind-tools: add 9.16.42
    
    Bug: https://bugs.gentoo.org/912265
    Signed-off-by: Sam James <[e-mail]>

 net-dns/bind-tools/Manifest                  |   1 +
 net-dns/bind-tools/bind-tools-9.16.42.ebuild | 160 +++++++++++++++++++++++++++
 2 files changed, 161 insertions(+)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bec68fa66f768fab49bc999fcd86b8d7d5cff441

commit bec68fa66f768fab49bc999fcd86b8d7d5cff441
Author:     Sam James <[e-mail]>
AuthorDate: 2023-08-14 08:27:45 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2023-08-14 08:27:45 +0000

    net-dns/bind: add 9.16.42
    
    Bug: https://bugs.gentoo.org/912265
    Signed-off-by: Sam James <[e-mail]>

 net-dns/bind/Manifest            |   1 +
 net-dns/bind/bind-9.16.42.ebuild | 382 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 383 insertions(+)

[Comment 2 Larry the Git Cow 2024-02-18 10:53:45 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=65133d310b8d8666267d37be0c42aad16eecdfff

commit 65133d310b8d8666267d37be0c42aad16eecdfff
Author:     Sam James <[e-mail]>
AuthorDate: 2024-02-18 10:52:52 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-02-18 10:52:52 +0000

    net-dns/bind: drop 9.16.37, 9.16.39, 9.16.41
    
    Bug: https://bugs.gentoo.org/912265
    Signed-off-by: Sam James <[e-mail]>

 net-dns/bind/Manifest            |   3 -
 net-dns/bind/bind-9.16.37.ebuild | 382 --------------------------------------
 net-dns/bind/bind-9.16.39.ebuild | 382 --------------------------------------
 net-dns/bind/bind-9.16.41.ebuild | 389 ---------------------------------------
 4 files changed, 1156 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=2d2d226864aaa3ac2dd24ec11f481832989bb1ab

commit 2d2d226864aaa3ac2dd24ec11f481832989bb1ab
Author:     Sam James <[e-mail]>
AuthorDate: 2024-02-18 10:52:36 +0000
Commit:     Sam James <[e-mail]>
CommitDate: 2024-02-18 10:52:36 +0000

    net-dns/bind-tools: drop 9.16.37-r1, 9.16.39, 9.16.41
    
    Bug: https://bugs.gentoo.org/912265
    Signed-off-by: Sam James <[e-mail]>

 net-dns/bind-tools/Manifest                     |   3 -
 net-dns/bind-tools/bind-tools-9.16.37-r1.ebuild | 160 -----------------------
 net-dns/bind-tools/bind-tools-9.16.39.ebuild    | 160 -----------------------
 net-dns/bind-tools/bind-tools-9.16.41.ebuild    | 167 ------------------------
 4 files changed, 490 deletions(-)