bind: bump to 9.20.29

Includes several security fixes:

 - CVE-2026-19668 Prevent excessive CPU use validating crafted DNSSEC
   responses.

 - CVE-2026-19033 Require a TSIG on every message of incoming zone
   transfers.

 - CVE-2026-77119 Prevent a DNSSEC downgrade of secure delegations via
   unrelated NSEC3.

 - CVE-2026-19941 Prevent forged DNSSEC-validated NXDOMAIN responses.

 - CVE-2026-19666 DNS64 with break-dnssec could cause an assertion failure.

 - CVE-2026-19667 Reject negative cache records that do not fit in a
   dns_rdata_t.

 - CVE-2026-19662 Prevent resolver crash with cached DNSSEC proofs.

 - CVE-2026-75029 Discard repeated SOA, CNAME, and DNAME records when
   parsing DNS messages.

 - CVE-2026-77692 Fix an unauthenticated crash on HTTPS using SIG(0)

 - CVE-2026-81736 Cached HTTPS/SVCB aliases could exhaust resolver CPU.

 - CVE-2026-76163 Prevent TKEY queries from terminating named without global
   options.

 - CVE-2026-78301 Out-of-zone records in a zone database could be served as
   authoritative.

 - CVE-2026-80274 Crash on wildcard answers carrying both NSEC and NSEC3
   proofs.

 - CVE-2026-81563 Following HTTPS/SVCB aliases could leak resolver cache
   memory.

Complete upstream changelog is available at
https://ftp.isc.org/isc/bind9/9.20.29/doc/arm/html/changelog.html

Signed-off-by: Noah Meyerhans <redacted>

diff --git a/net/bind/Makefile b/net/bind/Makefile
index 6c482fb4503625c3d3e5197202300e02b2d5370c..8d3252295a6748b9529e59061954aa263e2890c3 100644 (file)
--- a/net/bind/Makefile
+++ b/net/bind/Makefile
@@ -9,8 +9,8 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bind
-PKG_VERSION:=9.20.26
-PKG_RELEASE:=2
+PKG_VERSION:=9.20.29
+PKG_RELEASE:=1
 USERID:=bind=57:bind=57
 
 PKG_MAINTAINER:=Noah Meyerhans <frodo@morgul.net>
@@ -22,7 +22,7 @@ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:= \
        https://www.mirrorservice.org/sites/ftp.isc.org/isc/bind9/$(PKG_VERSION) \
        https://ftp.isc.org/isc/bind9/$(PKG_VERSION)
-PKG_HASH:=55248def0f870c4c46b3de72978ea972615131516663188a4564dca1d20bf350
+PKG_HASH:=587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1
 
 PKG_INSTALL:=1
 PKG_BUILD_FLAGS:=no-mips16

diff --git a/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch b/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch
index 8c401286a7e7492dedb72049e72dc10f2d37b083..2546cd8dfb2815079f0ab2c6b22c6baa7e4ed17f 100644 (file)
--- a/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch
+++ b/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch
@@ -13,7 +13,7 @@ restore the automatic zone to the view.
 
 --- a/bin/named/server.c
 +++ b/bin/named/server.c
-@@ -13934,6 +13934,7 @@ do_addzone(named_server_t *server, ns_cf
+@@ -13942,6 +13942,7 @@ do_addzone(named_server_t *server, ns_cf
           bool redirect, isc_buffer_t **text) {
        isc_result_t result, tresult;
        dns_zone_t *zone = NULL;
@@ -21,7 +21,7 @@ restore the automatic zone to the view.
        bool locked = false;
  #ifndef HAVE_LMDB
        FILE *fp = NULL;
-@@ -13952,7 +13953,13 @@ do_addzone(named_server_t *server, ns_cf
+@@ -13960,7 +13961,13 @@ do_addzone(named_server_t *server, ns_cf
        } else {
                result = dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone);
                if (result == ISC_R_SUCCESS) {
@@ -36,7 +36,7 @@ restore the automatic zone to the view.
                }
        }
        if (result != ISC_R_NOTFOUND) {
-@@ -13961,6 +13968,10 @@ do_addzone(named_server_t *server, ns_cf
+@@ -13969,6 +13976,10 @@ do_addzone(named_server_t *server, ns_cf
  
        isc_loopmgr_pause(named_g_loopmgr);
  
@@ -47,7 +47,7 @@ restore the automatic zone to the view.
  #ifndef HAVE_LMDB
        /*
         * Make sure we can open the configuration save file
-@@ -14065,6 +14076,11 @@ do_addzone(named_server_t *server, ns_cf
+@@ -14073,6 +14084,11 @@ do_addzone(named_server_t *server, ns_cf
                /* Remove the zone from the zone table */
                dns_view_delzone(view, zone);
                goto cleanup;
@@ -59,7 +59,7 @@ restore the automatic zone to the view.
        }
  
        /* Flag the zone as having been added at runtime */
-@@ -14081,6 +14097,22 @@ do_addzone(named_server_t *server, ns_cf
+@@ -14089,6 +14105,22 @@ do_addzone(named_server_t *server, ns_cf
  
  cleanup: