[SECURITY] Fedora 38 Update: bind-dyndb-ldap-11.10-17.fc38
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2023-8e1ddb1fa2
2023-06-25 00:49:42.634050
--------------------------------------------------------------------------------
Name : bind-dyndb-ldap
Product : Fedora 38
Version : 11.10
Release : 17.fc38
URL : https://releases.pagure.org/bind-dyndb-ldap
Summary : LDAP back-end plug-in for BIND
Description :
This package provides an LDAP back-end plug-in for BIND. It features
support for dynamic updates and internal caching, to lift the load
off of your LDAP server.
--------------------------------------------------------------------------------
Update Information:
# Update to BIND 9.18.16 Selected parts from [upstream release notes](https://d
ownloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-
bind-9-18-16). Visit that for details of bug fixes. ## Security Fixes - The
overmem cleaning process has been improved, to prevent the cache from
significantly exceeding the configured max-cache-size limit. (CVE-2023-2828)
ISC would like to thank Shoham Danino from Reichman University, Anat Bremler-
Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv University, and Yuval
Shavitt from Tel-Aviv University for bringing this vulnerability to our
attention. [GL #4055] - A query that prioritizes stale data over lookup
triggers a fetch to refresh the stale data in cache. If the fetch is aborted for
exceeding the recursion quota, it was possible for named to enter an infinite
callback loop and crash due to stack overflow. This has been fixed.
(CVE-2023-2911) [GL #4089] ## New Features - The system test suite can now
be executed with pytest (along with pytest-xdist for parallel execution). [GL
#3978] ## Removed Features - TKEY mode 2 (Diffie-Hellman Exchanged Keying)
is now deprecated, and will be removed in a future release. A warning will be
logged when the tkey-dhkey option is used in named.conf. [GL #3905]
--------------------------------------------------------------------------------
ChangeLog:
* Wed Jun 21 2023 Petr Men����k <pemensik(a)redhat.com> - 11.10-17
- Rebuild for BIND 9.18.16 (#2216462)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2216462 - bind-9.18.16 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2216462
[ 2 ] Bug #2216627 - TRIAGE-CVE-2023-2828 bind: named's configured cache size limit
can be significantly exceeded [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2216627
[ 3 ] Bug #2216630 - TRIAGE-CVE-2023-2911 bind: Exceeding the recursive-clients quota
may cause named to terminate unexpectedly when stale-answer-client-timeout is set to 0
[fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=2216630
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2023-8e1ddb1fa2' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------