[ubuntu/eoan-security] bind9 1:9.11.5.P4+dfsg-5.1ubuntu2.2 (Accepted)

[Marc Deslauriers]

bind9 (1:9.11.5.P4+dfsg-5.1ubuntu2.2) eoan-security; urgency=medium

  * SECURITY UPDATE: BIND does not sufficiently limit the number of fetches
    performed when processing referrals
    - debian/patches/CVE-2020-8616.patch: further limit the number of
      queries that can be triggered from a request in lib/dns/adb.c,
      lib/dns/include/dns/adb.h, lib/dns/resolver.c.
    - CVE-2020-8616
  * SECURITY UPDATE: A logic error in code which checks TSIG validity can
    be used to trigger an assertion failure in tsig.c
    - debian/patches/CVE-2020-8617.patch: don't allow replaying a TSIG
      BADTIME response in lib/dns/tsig.c.
    - CVE-2020-8617

Date: 2020-05-15 13:25:17.853572+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
https://launchpad.net/ubuntu/+source/bind9/1:9.11.5.P4+dfsg-5.1ubuntu2.2
-------------- next part --------------
Sorry, changesfile not available.