From: Noah Meyerhans Date: Fri, 18 Sep 2026 14:56:47 +0000 (-0400) Subject: bind: bump to 9.20.29 X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=799265743741fec9f44ad680957d6ce0c6902c2e;p=openwrt-packages.git bind: bump to 9.20.29 Includes several security fixes: - CVE-2026-19668 Prevent excessive CPU use validating crafted DNSSEC responses. - CVE-2026-19033 Require a TSIG on every message of incoming zone transfers. - CVE-2026-77119 Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3. - CVE-2026-19941 Prevent forged DNSSEC-validated NXDOMAIN responses. - CVE-2026-19666 DNS64 with break-dnssec could cause an assertion failure. - CVE-2026-19667 Reject negative cache records that do not fit in a dns_rdata_t. - CVE-2026-19662 Prevent resolver crash with cached DNSSEC proofs. - CVE-2026-75029 Discard repeated SOA, CNAME, and DNAME records when parsing DNS messages. - CVE-2026-77692 Fix an unauthenticated crash on HTTPS using SIG(0) - CVE-2026-81736 Cached HTTPS/SVCB aliases could exhaust resolver CPU. - CVE-2026-76163 Prevent TKEY queries from terminating named without global options. - CVE-2026-78301 Out-of-zone records in a zone database could be served as authoritative. - CVE-2026-80274 Crash on wildcard answers carrying both NSEC and NSEC3 proofs. - CVE-2026-81563 Following HTTPS/SVCB aliases could leak resolver cache memory. Complete upstream changelog is available at https://ftp.isc.org/isc/bind9/9.20.29/doc/arm/html/changelog.html Signed-off-by: Noah Meyerhans --- diff --git a/net/bind/Makefile b/net/bind/Makefile index 6c482fb45..8d3252295 100644 --- a/net/bind/Makefile +++ b/net/bind/Makefile @@ -9,8 +9,8 @@ include $(TOPDIR)/rules.mk PKG_NAME:=bind -PKG_VERSION:=9.20.26 -PKG_RELEASE:=2 +PKG_VERSION:=9.20.29 +PKG_RELEASE:=1 USERID:=bind=57:bind=57 PKG_MAINTAINER:=Noah Meyerhans @@ -22,7 +22,7 @@ PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz PKG_SOURCE_URL:= \ https://www.mirrorservice.org/sites/ftp.isc.org/isc/bind9/$(PKG_VERSION) \ https://ftp.isc.org/isc/bind9/$(PKG_VERSION) -PKG_HASH:=55248def0f870c4c46b3de72978ea972615131516663188a4564dca1d20bf350 +PKG_HASH:=587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1 PKG_INSTALL:=1 PKG_BUILD_FLAGS:=no-mips16 diff --git a/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch b/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch index 8c401286a..2546cd8df 100644 --- a/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch +++ b/net/bind/patches/fix-usr-allow-rndc-addzone#1.patch @@ -13,7 +13,7 @@ restore the automatic zone to the view. --- a/bin/named/server.c +++ b/bin/named/server.c -@@ -13934,6 +13934,7 @@ do_addzone(named_server_t *server, ns_cf +@@ -13942,6 +13942,7 @@ do_addzone(named_server_t *server, ns_cf bool redirect, isc_buffer_t **text) { isc_result_t result, tresult; dns_zone_t *zone = NULL; @@ -21,7 +21,7 @@ restore the automatic zone to the view. bool locked = false; #ifndef HAVE_LMDB FILE *fp = NULL; -@@ -13952,7 +13953,13 @@ do_addzone(named_server_t *server, ns_cf +@@ -13960,7 +13961,13 @@ do_addzone(named_server_t *server, ns_cf } else { result = dns_view_findzone(view, name, DNS_ZTFIND_EXACT, &zone); if (result == ISC_R_SUCCESS) { @@ -36,7 +36,7 @@ restore the automatic zone to the view. } } if (result != ISC_R_NOTFOUND) { -@@ -13961,6 +13968,10 @@ do_addzone(named_server_t *server, ns_cf +@@ -13969,6 +13976,10 @@ do_addzone(named_server_t *server, ns_cf isc_loopmgr_pause(named_g_loopmgr); @@ -47,7 +47,7 @@ restore the automatic zone to the view. #ifndef HAVE_LMDB /* * Make sure we can open the configuration save file -@@ -14065,6 +14076,11 @@ do_addzone(named_server_t *server, ns_cf +@@ -14073,6 +14084,11 @@ do_addzone(named_server_t *server, ns_cf /* Remove the zone from the zone table */ dns_view_delzone(view, zone); goto cleanup; @@ -59,7 +59,7 @@ restore the automatic zone to the view. } /* Flag the zone as having been added at runtime */ -@@ -14081,6 +14097,22 @@ do_addzone(named_server_t *server, ns_cf +@@ -14089,6 +14105,22 @@ do_addzone(named_server_t *server, ns_cf cleanup: