"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers. However, a defect in this feature makes it easy, when the feature is in use, to experience an assertion failure in name.c.
@maintainer(s): "ISC BIND 9.x versions prior to 9.11.4-P2 and 9.12.2-P2 are vulnerable. Not vulnerable version:
ISC Bind 9.13.3
ISC Bind 9.12.2-P2
ISC Bind 9.11.4-P2
Gentoo Security Padwan
@maintainer(s): any chance versions: 9.12.2_p1, 9.12.1_p2, 9.11.2_p1 are affected?
adding alias and additional link for tracking purposes:
@maintainers, please call for stable when ready.
Stabilized from Bug #657654
GLSA Vote: Yes
Added to an existing GLSA Request.
This issue was resolved and addressed in
GLSA 201903-13 at https://security.gentoo.org/glsa/201903-13
by GLSA coordinator Aaron Bauman (b-man).