rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity
The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
1,158 Commits 9 Branches 100 Tags 8.4 MiB
C 52.8%
Roff 23.8%
Shell 23.2%
Makefile 0.2%
c10s
Go to file
Petr Menšík 7c61856b69 [9.18] [CVE-2026-3592] sec: usr: Limit resolver server list size 
When resolving a domain with many nameservers that share overlapping IP addresses (e.g., 10 NS records all pointing at the same set of addresses), BIND could previously waste time querying duplicate addresses and build up excessively large server lists. Deduplicate addresses in the resolver's server list so that each unique IP is only queried once per resolution attempt, regardless of how many NS records point to it and cap the number of addresses stored per nameserver name to 6 (combined A and AAAA), preventing memory and CPU overhead from domains with unusually large NS/glue sets.

Closes isc-projects/bind9#5641

RH:
No tests are backported, because python tests have good enough support
for it.

Resolves: RHEL-189748
CVE: CVE-2026-3592
2026-08-19 16:46:10 +02:00
.fmf Adding fmf plan 2022-01-04 11:16:17 +01:00
.gitignore Do not add each release to gitignore 2025-02-10 20:47:08 +01:00
bind97-exportlib.patch update to 9.9.3rc2 2013-05-13 12:50:46 +02:00
bind-9.5-PIE.patch Update to 9.18.32 (rhbz#2331675) 2025-02-10 20:47:05 +01:00
bind-9.11.12.tar.gz.asc fixup! Update to 9.11.12 (#1557762) 2019-10-21 15:44:10 +02:00
bind-9.14.7.tar.gz.asc Update to 9.14.7 2020-03-27 11:25:12 +01:00
bind-9.16-redhat_doc.patch Import version from branch v9_18 2022-08-03 20:37:06 +02:00
bind-9.18-configurable-additional-records.patch Add runtime tunable limit for max additional records 2025-09-01 16:51:19 +02:00
bind-9.18-CVE-2025-8677.patch Prevent malformed DNSKEY to overload CPU (CVE-2025-8677) 2025-11-10 19:14:45 +01:00
bind-9.18-CVE-2025-40778.patch Address various spoofing attacks (CVE-2025-40778) 2025-11-10 19:16:42 +01:00
bind-9.18-CVE-2025-40780.patch Prevent cache poisoning due to weak PRNG (CVE-2025-40780) 2025-11-10 19:16:49 +01:00
bind-9.18-CVE-2026-1519-test.patch [9.18] [CVE-2026-1519] sec: usr: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations 2026-04-17 13:01:19 +02:00
bind-9.18-CVE-2026-1519.patch [9.18] [CVE-2026-1519] sec: usr: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations 2026-04-17 13:01:19 +02:00
bind-9.18-CVE-2026-3039.patch [9.18] [CVE-2026-3039] sec: usr: Fix GSS-API resource leak 2026-06-24 15:02:50 +02:00
bind-9.18-CVE-2026-3592.patch [9.18] [CVE-2026-3592] sec: usr: Limit resolver server list size 2026-08-19 16:46:10 +02:00
bind-9.18-CVE-2026-5946.patch [9.18] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN views 2026-06-24 15:03:14 +02:00
bind-9.18-CVE-2026-5950.patch [9.18] [CVE-2026-5950] sec: usr: Avoid unbounded recursion loop 2026-08-19 16:46:10 +02:00
bind-9.18-CVE-2026-10723.patch Fix CVE-2026-10723: validate NSEC3 signer matches owning zone 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-11331-test.patch fixup! Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-11331.patch Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) 2026-08-13 13:27:46 +02:00
bind-9.18-CVE-2026-11622.patch Fix CVE-2026-11622: reference-counted dns_slabheaders in cache 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-11721-fix2.patch fixup! Fix CVE-2026-11721: RRSIG label count validation for wildcard cache poisoning 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-11721-test.patch fixup! Fix CVE-2026-11721: RRSIG label count validation for wildcard cache poisoning 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-11721.patch fixup! Fix CVE-2026-11721: RRSIG label count validation for wildcard cache poisoning 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-13204.patch Fix CVE-2026-13204: assertion failure on malformed NSEC/NSEC3 responses 2026-08-13 12:56:46 +02:00
bind-9.18-CVE-2026-13321.patch Fix CVE-2026-13321: reject out-of-zone NSEC next owner names 2026-08-13 13:29:05 +02:00
bind-9.18-dig-idn-input-always-test.patch Fix expectations on idna system test 2025-09-16 12:03:49 +02:00
bind-9.18-dig-idn-input-always.patch Decode IDN names on input in all situations in utilities 2025-09-15 12:44:24 +02:00
bind-9.18-partial-additional-records.patch Change additional NS to be served partially 2025-09-01 16:38:38 +02:00
bind-9.18-pkcs11-provider.patch Attempt to backport OpenSSL provider support with labels 2025-08-14 13:01:48 +02:00
bind-9.18-query-fname-relative.patch Add extra protections to places needing absolute names 2025-06-16 04:20:35 +02:00
bind-9.18-unittest-netmgr-unstable.patch Disable more test cases in netmgr_test (#2122010) 2022-09-14 15:59:18 +02:00
bind-9.20-CVE-2025-8677-dual-signing-test.patch Add test case into dnssec system test for new regression 2025-11-10 19:16:55 +01:00
bind-9.20-CVE-2025-8677-dual-signing.patch Fix regression in upstream CVE-2025-8677 fix 2025-11-10 19:16:55 +01:00
bind-9.20-nsupdate-tls-doc.patch Backport nsupdate TLS support 2025-02-11 12:50:46 +01:00
bind-9.20-nsupdate-tls-test.patch Include a test for nsupdate changes 2025-02-11 12:50:46 +01:00
bind-9.20-nsupdate-tls.patch Updates to nsupdate TLS backport fixing memory 2025-02-11 12:50:46 +01:00
bind-9.20-robust-key-rollovers-tests.patch Backport fix for manual DNSSEC key rolllovers. 2026-02-03 17:48:06 +01:00
bind-9.20-robust-key-rollovers.patch Backport fix for manual DNSSEC key rolllovers. 2026-02-03 17:48:06 +01:00
bind-9.20-stale-cname-tests.patch Backport fixes for stale CNAME chains. 2026-02-26 12:17:39 +01:00
bind-9.20-stale-cname.patch Backport fixes for stale CNAME chains. 2026-02-26 12:17:39 +01:00
bind-9.21-resume-qmin-cname.patch Prevent name.c:670: REQUIRE((name1->attributes & 0x00000001) == (name2->attributes & 0x00000001)) failed 2025-06-10 20:14:45 +02:00
bind-chroot.tmpfiles.d Add forgotten _libdir/named into bind-chroot tmpfiles 2026-01-28 11:32:01 +01:00
bind.spec [9.18] [CVE-2026-3592] sec: usr: Limit resolver server list size 2026-08-19 16:46:10 +02:00
bind.tmpfiles.d Move named.local* and named.empty into /usr/share/named 2025-10-10 20:22:31 +02:00
Changes.md Update Changes and README to match 9.16 release 2021-01-15 17:09:33 +01:00
ci.fmf adding ci.fmf with multiple plans support 2022-01-25 11:35:08 +00:00
codesign2019.txt Import version from branch v9_18 2022-08-03 20:37:06 +02:00
gating.yaml c10s: fmf plans and gatying for RHEL CI 2024-05-28 10:19:14 +02:00
generate-rndc-key.sh Correct shell warnings detected by coverity 2022-01-18 14:31:43 +01:00
isc-keyblock.asc Update to 9.18.16 (#2216462) 2023-06-22 00:34:42 +02:00
ldap2zone.c - updates due libtool 2.2.6 2008-11-24 12:59:15 +00:00
makefile-replace-libs.py Add helper for testing system daemons 2019-11-07 14:41:36 +01:00
named-chroot-setup.service Use new config named-chroot.files for chroot setup files (#1429656) 2018-07-13 14:11:20 +02:00
named-chroot.files Move named.local* and named.empty into /usr/share/named 2025-10-10 20:22:31 +02:00
named-chroot.service Enable automatic restart on crashes 2022-09-30 12:58:12 +02:00
named-setup-rndc.service Rework the chroot setup/destruction workflow 2013-12-17 17:09:44 +01:00
named.conf Update configuration to 9.16 2020-04-24 15:21:33 +02:00
named.conf.sample Replace master with primary in configuration 2022-01-25 15:07:27 +01:00
named.empty Remove config archive with zone files 2019-11-04 21:45:08 +01:00
named.localhost Remove config archive with zone files 2019-11-04 21:45:08 +01:00
named.logrotate logrotate: skip if empty and remove old variants 2025-09-12 15:45:55 +02:00
named.loopback Remove config archive with zone files 2019-11-04 21:45:08 +01:00
named.rfc1912.zones Replace master with primary in configuration 2022-01-25 15:07:27 +01:00
named.root Update changed b.root-servers.net address in hints (#2253460) 2024-01-16 11:14:58 +01:00
named.root.key Replace initial key with just digest of it 2020-04-27 12:21:58 +02:00
named.rwtab Install configuration for rwtab and fix chroot setup script 2013-11-12 14:29:33 +01:00
named.service Enable automatic restart on crashes 2022-09-30 12:58:12 +02:00
named.sysconfig Make comment how to use different config file 2017-07-14 17:02:15 +02:00
named.sysusers Add sysusers named user creation (rhbz#2105415) 2025-02-10 20:47:08 +01:00
plans.fmf https://issues.redhat.com/browse/RHELMISC-13073 2025-06-05 12:15:23 +02:00
README.md Import version from branch v9_18 2022-08-03 20:37:06 +02:00
setup-named-chroot.sh Import version from branch v9_18 2022-08-03 20:37:06 +02:00
setup-named-softhsm.sh Fix spec usage of softhsm helper 2019-02-22 16:39:54 +01:00
softhsm2.conf.in Enable unit tests with kyua tool (#1532694) 2018-01-09 18:19:43 +01:00
sources Update to 9.16.33 (rhbz#2342784) 2025-02-10 20:47:08 +01:00
trusted-key.key Remove revoked KSK 19164 from trusted root keys 2019-02-15 19:50:20 +01:00

README.md

BIND 9

BIND (Berkeley Internet Name Domain) is a complete, highly portable implementation of the DNS (Domain Name System) protocol.

Internet Systems Consortium (https://www.isc.org), a 501(c)(3) public benefit corporation dedicated to providing software and services in support of the Internet infrastructure, developed BIND 9 and is responsible for its ongoing maintenance and improvement.

More details about upstream project can be found on their gitlab. This repository contains only upstream sources and packaging instructions for Fedora Project.

Subpackages

The package contains several subpackages, some of them can be disabled on rebuild.

  • bind -- named daemon providing DNS server
  • bind-utils -- set of tools to analyse DNS responses or update entries (dig, host)
  • bind-doc -- documentation for current bind, BIND 9 Administrator Reference Manual.
  • bind-license -- Shared license for all packages but bind-export-libs.
  • bind-libs -- Shared libraries used by some others programs
  • bind-devel -- Development headers for libs. Can be disabled by --without DEVEL

Optional features

  • GSSTSIG -- Support for Kerberos authentication in BIND.
  • LMDB -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
  • DLZ -- Support for dynamic loaded modules providing support for features bind-sdb provides, but only small module is required.