rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity
The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server
1,152 Commits 9 Branches 100 Tags 8.4 MiB
C 52.8%
Roff 23.8%
Shell 23.2%
Makefile 0.2%
f3827d3413
Go to file
RHEL Packaging Agent f3827d3413 Fix CVE-2026-13321: reject out-of-zone NSEC next owner names 
Add patch to reject out-of-zone NSEC next owner names, which
could allow a malicious zone to cover a victim zone for
non-existence in a DNSSEC validating resolver's cache, bypassing
DNSSEC validation (CVE-2026-13321).

The patch includes system tests, the upstream fix, and an
adaptation to the bind-9.18 codebase to resolve a compilation
issue with the cherry-picked commits.

CVE: CVE-2026-13321
Upstream patches:
 - 36f3d50f9c.patch
Resolves: RHEL-213324

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-13 13:29:05 +02:00
.fmf Adding fmf plan 2022-01-04 11:16:17 +01:00
.gitignore Do not add each release to gitignore 2025-02-10 20:47:08 +01:00
bind97-exportlib.patch update to 9.9.3rc2 2013-05-13 12:50:46 +02:00
bind-9.5-PIE.patch Update to 9.18.32 (rhbz#2331675) 2025-02-10 20:47:05 +01:00
bind-9.11.12.tar.gz.asc fixup! Update to 9.11.12 (#1557762) 2019-10-21 15:44:10 +02:00
bind-9.14.7.tar.gz.asc Update to 9.14.7 2020-03-27 11:25:12 +01:00
bind-9.16-redhat_doc.patch Import version from branch v9_18 2022-08-03 20:37:06 +02:00
bind-9.18-configurable-additional-records.patch Add runtime tunable limit for max additional records 2025-09-01 16:51:19 +02:00
bind-9.18-CVE-2025-8677.patch Prevent malformed DNSKEY to overload CPU (CVE-2025-8677) 2025-11-10 19:14:45 +01:00
bind-9.18-CVE-2025-40778.patch Address various spoofing attacks (CVE-2025-40778) 2025-11-10 19:16:42 +01:00
bind-9.18-CVE-2025-40780.patch Prevent cache poisoning due to weak PRNG (CVE-2025-40780) 2025-11-10 19:16:49 +01:00
bind-9.18-CVE-2026-1519-test.patch [9.18] [CVE-2026-1519] sec: usr: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations 2026-04-17 13:01:19 +02:00
bind-9.18-CVE-2026-1519.patch [9.18] [CVE-2026-1519] sec: usr: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations 2026-04-17 13:01:19 +02:00
bind-9.18-CVE-2026-3039.patch [9.18] [CVE-2026-3039] sec: usr: Fix GSS-API resource leak 2026-06-24 15:02:50 +02:00
bind-9.18-CVE-2026-5946.patch [9.18] [CVE-2026-5946] sec: usr: Disable recursion, UPDATE, and NOTIFY for non-IN views 2026-06-24 15:03:14 +02:00
bind-9.18-CVE-2026-11331.patch Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) 2026-08-13 13:27:46 +02:00
bind-9.18-CVE-2026-11622.patch Fix CVE-2026-11622: reference-counted dns_slabheaders in cache 2026-08-13 13:29:05 +02:00
bind-9.18-CVE-2026-11721.patch Fix CVE-2026-11721: RRSIG label count validation for wildcard cache poisoning 2026-08-13 13:28:49 +02:00
bind-9.18-CVE-2026-13204.patch Fix CVE-2026-13204: assertion failure on malformed NSEC/NSEC3 responses 2026-08-13 12:56:46 +02:00
bind-9.18-CVE-2026-13321.patch Fix CVE-2026-13321: reject out-of-zone NSEC next owner names 2026-08-13 13:29:05 +02:00
bind-9.18-dig-idn-input-always-test.patch Fix expectations on idna system test 2025-09-16 12:03:49 +02:00
bind-9.18-dig-idn-input-always.patch Decode IDN names on input in all situations in utilities 2025-09-15 12:44:24 +02:00
bind-9.18-partial-additional-records.patch Change additional NS to be served partially 2025-09-01 16:38:38 +02:00
bind-9.18-pkcs11-provider.patch Attempt to backport OpenSSL provider support with labels 2025-08-14 13:01:48 +02:00
bind-9.18-query-fname-relative.patch Add extra protections to places needing absolute names 2025-06-16 04:20:35 +02:00
bind-9.18-unittest-netmgr-unstable.patch Disable more test cases in netmgr_test (#2122010) 2022-09-14 15:59:18 +02:00
bind-9.20-CVE-2025-8677-dual-signing-test.patch Add test case into dnssec system test for new regression 2025-11-10 19:16:55 +01:00
bind-9.20-CVE-2025-8677-dual-signing.patch Fix regression in upstream CVE-2025-8677 fix 2025-11-10 19:16:55 +01:00
bind-9.20-nsupdate-tls-doc.patch Backport nsupdate TLS support 2025-02-11 12:50:46 +01:00
bind-9.20-nsupdate-tls-test.patch Include a test for nsupdate changes 2025-02-11 12:50:46 +01:00
bind-9.20-nsupdate-tls.patch Updates to nsupdate TLS backport fixing memory 2025-02-11 12:50:46 +01:00
bind-9.20-robust-key-rollovers-tests.patch Backport fix for manual DNSSEC key rolllovers. 2026-02-03 17:48:06 +01:00
bind-9.20-robust-key-rollovers.patch Backport fix for manual DNSSEC key rolllovers. 2026-02-03 17:48:06 +01:00
bind-9.20-stale-cname-tests.patch Backport fixes for stale CNAME chains. 2026-02-26 12:17:39 +01:00
bind-9.20-stale-cname.patch Backport fixes for stale CNAME chains. 2026-02-26 12:17:39 +01:00
bind-9.21-resume-qmin-cname.patch Prevent name.c:670: REQUIRE((name1->attributes & 0x00000001) == (name2->attributes & 0x00000001)) failed 2025-06-10 20:14:45 +02:00
bind-chroot.tmpfiles.d Add forgotten _libdir/named into bind-chroot tmpfiles 2026-01-28 11:32:01 +01:00
bind.spec Fix CVE-2026-13321: reject out-of-zone NSEC next owner names 2026-08-13 13:29:05 +02:00
bind.tmpfiles.d Move named.local* and named.empty into /usr/share/named 2025-10-10 20:22:31 +02:00
Changes.md Update Changes and README to match 9.16 release 2021-01-15 17:09:33 +01:00
ci.fmf adding ci.fmf with multiple plans support 2022-01-25 11:35:08 +00:00
codesign2019.txt Import version from branch v9_18 2022-08-03 20:37:06 +02:00
gating.yaml c10s: fmf plans and gatying for RHEL CI 2024-05-28 10:19:14 +02:00
generate-rndc-key.sh Correct shell warnings detected by coverity 2022-01-18 14:31:43 +01:00
isc-keyblock.asc Update to 9.18.16 (#2216462) 2023-06-22 00:34:42 +02:00
ldap2zone.c - updates due libtool 2.2.6 2008-11-24 12:59:15 +00:00
makefile-replace-libs.py Add helper for testing system daemons 2019-11-07 14:41:36 +01:00
named-chroot-setup.service Use new config named-chroot.files for chroot setup files (#1429656) 2018-07-13 14:11:20 +02:00
named-chroot.files Move named.local* and named.empty into /usr/share/named 2025-10-10 20:22:31 +02:00
named-chroot.service Enable automatic restart on crashes 2022-09-30 12:58:12 +02:00
named-setup-rndc.service Rework the chroot setup/destruction workflow 2013-12-17 17:09:44 +01:00
named.conf Update configuration to 9.16 2020-04-24 15:21:33 +02:00
named.conf.sample Replace master with primary in configuration 2022-01-25 15:07:27 +01:00
named.empty Remove config archive with zone files 2019-11-04 21:45:08 +01:00
named.localhost Remove config archive with zone files 2019-11-04 21:45:08 +01:00
named.logrotate logrotate: skip if empty and remove old variants 2025-09-12 15:45:55 +02:00
named.loopback Remove config archive with zone files 2019-11-04 21:45:08 +01:00
named.rfc1912.zones Replace master with primary in configuration 2022-01-25 15:07:27 +01:00
named.root Update changed b.root-servers.net address in hints (#2253460) 2024-01-16 11:14:58 +01:00
named.root.key Replace initial key with just digest of it 2020-04-27 12:21:58 +02:00
named.rwtab Install configuration for rwtab and fix chroot setup script 2013-11-12 14:29:33 +01:00
named.service Enable automatic restart on crashes 2022-09-30 12:58:12 +02:00
named.sysconfig Make comment how to use different config file 2017-07-14 17:02:15 +02:00
named.sysusers Add sysusers named user creation (rhbz#2105415) 2025-02-10 20:47:08 +01:00
plans.fmf https://issues.redhat.com/browse/RHELMISC-13073 2025-06-05 12:15:23 +02:00
README.md Import version from branch v9_18 2022-08-03 20:37:06 +02:00
setup-named-chroot.sh Import version from branch v9_18 2022-08-03 20:37:06 +02:00
setup-named-softhsm.sh Fix spec usage of softhsm helper 2019-02-22 16:39:54 +01:00
softhsm2.conf.in Enable unit tests with kyua tool (#1532694) 2018-01-09 18:19:43 +01:00
sources Update to 9.16.33 (rhbz#2342784) 2025-02-10 20:47:08 +01:00
trusted-key.key Remove revoked KSK 19164 from trusted root keys 2019-02-15 19:50:20 +01:00

README.md

BIND 9

BIND (Berkeley Internet Name Domain) is a complete, highly portable implementation of the DNS (Domain Name System) protocol.

Internet Systems Consortium (https://www.isc.org), a 501(c)(3) public benefit corporation dedicated to providing software and services in support of the Internet infrastructure, developed BIND 9 and is responsible for its ongoing maintenance and improvement.

More details about upstream project can be found on their gitlab. This repository contains only upstream sources and packaging instructions for Fedora Project.

Subpackages

The package contains several subpackages, some of them can be disabled on rebuild.

  • bind -- named daemon providing DNS server
  • bind-utils -- set of tools to analyse DNS responses or update entries (dig, host)
  • bind-doc -- documentation for current bind, BIND 9 Administrator Reference Manual.
  • bind-license -- Shared license for all packages but bind-export-libs.
  • bind-libs -- Shared libraries used by some others programs
  • bind-devel -- Development headers for libs. Can be disabled by --without DEVEL

Optional features

  • GSSTSIG -- Support for Kerberos authentication in BIND.
  • LMDB -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs.
  • DLZ -- Support for dynamic loaded modules providing support for features bind-sdb provides, but only small module is required.