rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity
The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
105 Commits 9 Branches 95 Tags 6.4 MiB
C 52.8%
Roff 23.8%
Shell 23.2%
Makefile 0.2%
c9s
Go to file
Petr Menšík b395b32cb5 [9.16] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN views 
Recursion, dynamic updates (UPDATE), and zone change notifications
(NOTIFY) are now disabled for views with a class other than IN
(such as CHAOS or HESIOD); authoritative service for non-IN zones
(e.g. version.bind in class CHAOS) continues to work as before.
Servers configured with recursion yes in a non-IN view will log a
warning at startup, and named-checkconf flags the same condition.
UPDATE and NOTIFY messages that specify the meta-classes ANY or NONE
in the question section are now rejected with FORMERR.

This addresses a set of closely related security issues collectively
identified as CVE-2026-5946. ISC would like to thank Mcsky23 for
bringing these issues to our attention.

[9.16] fix: dev: Pass empty string instead of NULL to ns_client_dumpmessage()

Pass "" instead of NULL to ns_client_dumpmessage() to get the log message printed.

Resolves-Vulnerability: CVE-2026-5946
Resolves: RHEL-177764
2026-06-24 14:56:58 +02:00
.fmf ci plans for rhel9 2025-10-14 12:03:41 +02:00
tests Merged update from upstream sources 2021-01-12 20:05:29 +00:00
.gitignore Update 9.16.23 2021-11-23 11:26:51 +01:00
bind93-rh490837.patch Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind97-exportlib.patch RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
bind97-rh645544.patch Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind-9.5-dlz-64bit.patch RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
bind-9.5-PIE.patch Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind-9.9.1-P2-dlz-libdb.patch RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
bind-9.10-dist-native-pkcs11.patch Update to 9.16.16 2021-07-22 00:31:03 +02:00
bind-9.11-feature-test-named.patch Properly test also gsstsig upstream test 2024-08-27 22:33:06 +02:00
bind-9.11-fips-disable.patch Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind-9.11-fips-tests.patch Update to 9.16.13 2021-05-04 14:08:10 +02:00
bind-9.11-kyua-pkcs11.patch Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind-9.11-rh1666814.patch Remove merged changes and update changed patch 2021-11-23 11:27:00 +01:00
bind-9.11-tests-variants.patch Update to 9.16.16 2021-07-22 00:31:03 +02:00
bind-9.11.12.tar.gz.asc RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
bind-9.14-config-pkcs11.patch Update to 9.16.13 2021-05-04 14:08:10 +02:00
bind-9.14-json-c.patch Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind-9.14.7.tar.gz.asc Merged update from upstream sources 2021-01-22 20:42:08 +00:00
bind-9.16-CVE-2021-25220-test.patch Add tests for forwarder cache poisoning scenarios 2022-04-11 18:07:08 +02:00
bind-9.16-CVE-2021-25220.patch Tighten cache protection against record from forwarders 2022-04-11 18:00:59 +02:00
bind-9.16-CVE-2022-0396.patch [CVE-2022-0396] Resolve #3112 TCP sockets stuck in CLOSE_WAIT 2022-03-25 21:03:37 +01:00
bind-9.16-CVE-2022-2795.patch Bound the amount of work performed for delegations 2022-10-04 19:52:37 +02:00
bind-9.16-CVE-2022-3080.patch Fix CVE-2022-3080 2022-09-22 22:14:55 +02:00
bind-9.16-CVE-2022-3094-1.patch Fix small differences to upstream patches 2023-02-25 03:10:37 +01:00
bind-9.16-CVE-2022-3094-2.patch Prevent flooding with UPDATE requests 2023-02-08 18:47:31 +01:00
bind-9.16-CVE-2022-3094-3.patch Prevent flooding with UPDATE requests 2023-02-08 18:47:31 +01:00
bind-9.16-CVE-2022-3094-test.patch Fix small differences to upstream patches 2023-02-25 03:10:37 +01:00
bind-9.16-CVE-2022-3736.patch Handle RRSIG queries when server-stale is active 2023-02-09 17:28:30 +01:00
bind-9.16-CVE-2022-3924.patch Fix crash when soft-quota is reached and serve-stale is active 2023-02-09 17:52:04 +01:00
bind-9.16-CVE-2022-38177.patch Fix CVE-2022-38177 2022-09-22 22:14:56 +02:00
bind-9.16-CVE-2022-38178.patch Fix CVE-2022-38178 2022-09-22 22:14:56 +02:00
bind-9.16-CVE-2023-2828.patch Fix CVE-2023-2828 2023-07-19 18:09:09 +02:00
bind-9.16-CVE-2023-2911-1.patch Fix CVE-2023-2911 2023-07-19 18:24:02 +02:00
bind-9.16-CVE-2023-2911-2.patch Fix CVE-2023-2911 2023-07-19 18:24:02 +02:00
bind-9.16-CVE-2023-2911-3.patch Fix CVE-2023-2911 2023-07-19 18:24:02 +02:00
bind-9.16-CVE-2023-3341.patch Fix CVE-2023-3341 2023-09-20 13:22:16 +02:00
bind-9.16-CVE-2023-4408-test1.patch Import tests for large DNS messages fix 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2023-4408-test2.patch Import tests for large DNS messages fix 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2023-4408.patch Prevent increased CPU load on large DNS messages 2024-03-26 12:05:22 +01:00
bind-9.16-CVE-2023-5517.patch Prevent assertion failure when nxdomain-redirect is used with 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2023-5679.patch Prevent assertion failure if DNS64 and serve-stale is used 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2023-6516-test.patch Stop crashes at masterformat system tests 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2023-6516.patch Specific recursive query patterns may lead to an out-of-memory condition 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2023-50387.patch Prevent increased CPU consumption in DNSSEC validator 2024-03-26 12:05:32 +01:00
bind-9.16-CVE-2024-1737-records-test2.patch Minor fix of reclimit test backport 2024-08-27 22:33:14 +02:00
bind-9.16-CVE-2024-1737-records-test.patch [9.16] chg: usr: Backport max-records-per-type to BIND 9.16 2024-08-27 22:32:42 +02:00
bind-9.16-CVE-2024-1737-records.patch [9.16] chg: usr: Backport max-records-per-type to BIND 9.16 2024-08-27 22:32:42 +02:00
bind-9.16-CVE-2024-1737-types-test.patch [9.16] chg: usr: Backport max-types-per-name to BIND 9.16 2024-08-27 22:32:58 +02:00
bind-9.16-CVE-2024-1737-types.patch [9.16] chg: usr: Backport max-types-per-name to BIND 9.16 2024-08-27 22:32:58 +02:00
bind-9.16-CVE-2024-1737.patch Resolve CVE-2024-1737 2024-08-27 22:29:25 +02:00
bind-9.16-CVE-2024-1975.patch Resolve CVE-2024-1975 2024-08-27 22:27:20 +02:00
bind-9.16-CVE-2025-40778.patch Address various spoofing attacks (CVE-2025-40778) 2025-11-10 19:10:54 +01:00
bind-9.16-CVE-2025-40780.patch Prevent cache poisoning due to weak PRNG (CVE-2025-40780) 2025-11-10 19:10:30 +01:00
bind-9.16-CVE-2026-1519.patch [9.16] [CVE-2026-1519] sec: usr: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations 2026-04-17 12:53:16 +02:00
bind-9.16-CVE-2026-3039.patch [9.16] [CVE-2026-3039] sec: usr: Fix GSS-API resource leak 2026-06-24 14:56:42 +02:00
bind-9.16-CVE-2026-5946.patch [9.16] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN views 2026-06-24 14:56:58 +02:00
bind-9.16-isc_hp-additional.patch Increase size of hazard pointer array 2024-07-09 16:36:12 +02:00
bind-9.16-isc_hp-CVE-2023-50387.patch Downstream specific changes related to KeyTrap 2024-03-26 12:05:32 +01:00
bind-9.16-isc-mempool-attach.patch Add mctx attach/detach when creating/destroying a memory pool 2024-03-26 12:05:32 +01:00
bind-9.16-properly-process-extra-nameserver-lines.patch Backport fix for nameserver line processing. 2026-01-22 16:44:14 +01:00
bind-9.16-redhat_doc.patch Update to 9.16.13 2021-05-04 14:08:10 +02:00
bind-9.16-rh2101712.patch fixup! Have dns_zt_apply lock the zone table 2023-02-27 14:44:05 +01:00
bind-9.16-rh2133889.patch Add include to rwlocktype_t to dns/zt.h 2023-01-21 00:03:05 +01:00
bind-9.16-system-test-cds.patch Define variables used for test variants 2024-03-26 12:05:32 +01:00
bind-9.16-update-b.root-servers.net.patch Update addresses of b.root-servers.net 2023-12-07 15:20:38 +01:00
bind-9.18-configurable-additional-records.patch Add runtime tunable limit for max additional records 2025-07-09 11:36:27 +02:00
bind-9.18-CVE-2024-4076.patch Resolve CVE-2024-4076 2024-08-27 22:30:26 +02:00
bind-9.18-CVE-2024-11187-pre-test.patch Fix vulnerability test backport 2025-03-13 15:30:32 +01:00
bind-9.18-CVE-2024-11187.patch Limit the additional processing for large RDATA sets 2025-03-13 15:30:25 +01:00
bind-9.18-dig-idn-input-always-test.patch Fix expectations on idna system test 2025-09-16 12:50:44 +02:00
bind-9.18-dig-idn-input-always.patch Decode IDN names on input in all situations in utilities 2025-09-03 19:21:46 +02:00
bind-9.18-fix-dig-hanging-issue.patch Backport fix of dig/nslookup hanging issue 2026-02-26 12:30:48 +01:00
bind-9.18-partial-additional-records.patch Change additional NS to be served partially 2025-06-20 20:57:37 +02:00
bind-9.18-query-fname-relative.patch Add extra protections to places needing absolute names 2025-06-10 20:03:10 +02:00
bind-9.20-robust-key-rollovers.patch Backport fix for manual DNSSEC key rolllovers. 2026-01-29 17:03:47 +01:00
bind-9.21-resume-qmin-cname.patch Prevent name.c:670: REQUIRE((name1->attributes & 0x00000001) == (name2->attributes & 0x00000001)) failed 2025-06-10 20:03:10 +02:00
bind-chroot.tmpfiles.d Add forgotten _libdir/named into bind-chroot tmpfiles 2026-01-28 11:24:50 +01:00
bind.spec [9.16] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN views 2026-06-24 14:56:58 +02:00
bind.tmpfiles.d Copy named.* into /usr/share/named 2025-12-01 19:50:50 +01:00
Changes.md Merged update from upstream sources 2021-01-22 20:42:08 +00:00
ci.fmf ci plans for rhel9 2025-10-14 12:03:41 +02:00
codesign2021.txt Merged update from upstream sources 2021-01-22 20:42:08 +00:00
gating.yaml ci plans for rhel9 2025-10-14 12:03:41 +02:00
generate-rndc-key.sh Merged update from upstream sources 2021-01-22 20:42:08 +00:00
ldap2zone.c RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
makefile-replace-libs.py RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named-chroot-setup.service RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named-chroot.files Copy named.* into /usr/share/named 2025-12-01 19:50:50 +01:00
named-chroot.service RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named-pkcs11.service RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named-setup-rndc.service RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.conf Merged update from upstream sources 2021-01-22 20:42:08 +00:00
named.conf.sample Merged update from upstream sources 2021-01-22 20:42:08 +00:00
named.empty RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.localhost RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.logrotate logrotate: skip if empty and remove old variants 2025-09-12 15:41:21 +02:00
named.loopback RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.rfc1912.zones RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.root Update addresses of b.root-servers.net 2023-12-07 15:20:38 +01:00
named.root.key Merged update from upstream sources 2021-01-22 20:42:08 +00:00
named.rwtab RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.service RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.sysconfig RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
named.sysusers Add sysusers named user creation (rhbz#2105415) 2025-12-17 14:41:57 +01:00
plans.fmf ci plans for rhel9 2025-10-14 12:03:41 +02:00
README.md Merged update from upstream sources 2021-01-22 20:42:08 +00:00
setup-named-chroot.sh RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
setup-named-softhsm.sh RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
softhsm2.conf.in RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00
sources Update 9.16.23 2021-11-23 11:26:51 +01:00
trusted-key.key RHEL 9.0.0 Alpha bootstrap 2020-10-14 22:16:50 +02:00

README.md

BIND 9

BIND (Berkeley Internet Name Domain) is a complete, highly portable implementation of the DNS (Domain Name System) protocol.

Internet Systems Consortium (https://www.isc.org), a 501(c)(3) public benefit corporation dedicated to providing software and services in support of the Internet infrastructure, developed BIND 9 and is responsible for its ongoing maintenance and improvement.

More details about upstream project can be found on their gitlab. This repository contains only upstream sources and packaging instructions for Fedora Project.

Subpackages

The package contains several subpackages, some of them can be disabled on rebuild.

  • bind -- named daemon providing DNS server
  • bind-utils -- set of tools to analyse DNS responses or update entries (dig, host)
  • bind-doc -- documentation for current bind, BIND 9 Administrator Reference Manual.
  • bind-license -- Shared license for all packages but bind-export-libs.
  • bind-pkcs11 -- named daemon built with native PKCS#11 support. Can be disabled by --without PKCS11.
  • bind-libs and bind-libs-lite -- Shared libraries used by some others programs
  • bind-devel -- Development headers for libs.
  • bind-dlz-* -- Dynamic loadable DLZ plugins with support for external databases

Optional features

  • GSSTSIG -- Support for Kerberos authentication in BIND.
  • LMDB -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
  • DLZ -- Support for dynamic loaded modules providing support for features bind-sdb provides, but only small module is required.