CVE-2019-6471

A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.

A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.

A race condition which may occur when discarding malformed packets can result in BIND exiting due to a REQUIRE assertion failure in dispatch.c. Versions affected: BIND 9.11.0 -> 9.11.7, 9.12.0 -> 9.12.4-P1, 9.14.0 -> 9.14.2. Also all releases of the BIND 9.13 development branch and version 9.15.0 of the BIND 9.15 development branch and BIND Supported Preview Edition versions 9.11.3-S1 -> 9.11.7-S1.

Updated bind packages fix security vulnerabilities

Limiting simultaneous TCP clients is ineffective (CVE-2018-5743)

Race condition when discarding malformed packets can cause bind to exit with assertion failure (CVE-2019-6471)

In addition to those two security issues, this package releases also fixes two additional issues:

• a missing conflict tag between old bind and bnew ind-utils subpackages, preventing upgrade due to a file conflict
• missing root.key file, despite this one being refered in default configuration

This update for bind fixes the following issues:

Security issue fixed:

• CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687)

Non-security issue fixed:

• bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368)

This update was imported from the SUSE:SLE-15:Update update project.

This update for bind fixes the following issues:

Security issue fixed:

• CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687)

Non-security issue fixed:

• bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368)

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the bind-9.16.20-1.4 package on the GA media of openSUSE Tumbleweed.

This update for bind fixes the following issues:

Security issues fixed:

• CVE-2019-6465: Fixed an issue where controls for zone transfers may not be properly applied to Dynamically Loadable Zones (bsc#1126069).
• CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687)
• CVE-2018-5745: Fixed a denial of service vulnerability if a trust anchor rolls over to an unsupported key algorithm when using managed-keys (bsc#1126068).
• CVE-2018-5743: Fixed a denial of service vulnerability which could be caused by to many simultaneous TCP connections (bsc#1133185).
• CVE-2018-5740: Fixed a denial of service vulnerability in the 'deny-answer-aliases' feature (bsc#1104129).

Non-security issues fixed:

• Don't rely on /etc/insserv.conf anymore for proper dependencies against nss-lookup.target in named.service and lwresd.service (bsc#1118367, bsc#1118368).
• Fix FIPS related regression (bsc#1128220).

This update for bind fixes the following issues:

Security issue fixed:

• CVE-2019-6471: Fixed a reachable assert in dispatch.c. (bsc#1138687)

Non-security issue fixed:

• bind will no longer rely on /etc/insserv.conf (bsc#1118367, bsc#1118368)

It was discovered that Bind incorrectly handled certain malformed packets. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service.