<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="59">
<package pkgid="9fe538f2f8b12a251cdda05e98a4f87fe7c1b6667b4e344d112599f07d33d8ecc981fa094a07dbeb2a708fb62713ff913737d919b3c4f8698da30698ec76b57f" name="bind" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="866edf16ef6cd304c335fecdda3388f0f71cc853cafb5cb23b2d45547a65bda310ab540b1c48db41a95bb2c54f760f6ae65f6a391d62504eb5ee9965820d730c" name="bind" arch="src">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="c205d302474dc32cd7d2dd5b39a0e4bf7672da5bec32bee41cc5cced30f2a5b75dd9a8390176cde513fdf7d804938be103877382e3986b5f4e2a1526e8c4c8fb" name="bind" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="0f2d1e57efdaa660dc32231240fb40e8f33f05c0181ed12702fe6527b3ac93c01563219204a5d5e1cbc0b7ca91f49424a5bcd435f428a09b5d61f3ce1464e471" name="bind-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="e4eb010931e8e6789ca0eac919ef95739e8aa922bd841c978376745d3623bcc2379d1b7ae2216f50f086d41a49370de4290fb872083eff09a2011f05a02a5c64" name="bind-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="d0cff1f98b3601144a5959cb3c2fb055bf63db95da167b96be0c2f4d36aafea7af0e9e66109c52f9ffd62c3991d6ee23cb5c94103d1ae50cca339749c460c38f" name="bind-debugsource" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="9559d94f9942dba4a3eeeb4774e6a18b3de8d508e339f974959c47a84ea590b6d109c266f6b4ff4fe5356cebb185f02c1c762e02ddf91e7e8f43cfce85b54dc0" name="bind-debugsource" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="40314539fa3ddb202da92c8517178614a1be3c05e3662349e7714dfd7ccdf25b6169d20443f5545a2e4d3e73725b901d501125f44de3bbdbad6b979ae66c53ae" name="bind-doc" arch="noarch">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="495477ac07a9daf83f6f1ff9841f63172cfeecd3fc88169c624eb06b30a0f30ef09768d9c3cb6c2b655964addcbab965d70fde03d5c2ac42744becd05d1dadf2" name="bind-modules-bdbhpt" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="174c534208ab7ab520a93cc4542d51492ad9cff782b75b4fbd0a80d16b8e576fc514ba8098845a9ee98c4c7808eb21bda9c8d86e6560d70db043651a513f5763" name="bind-modules-bdbhpt" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="80d29c7327e8da1ea279de5eae9458eaa1d8d7885cb06259e3ddc71e5dca2017e1f709e32b720b8eb65e33b5ea1b10ef22c63d3c7a2a629d3e70b3f2dca66984" name="bind-modules-bdbhpt-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="c1f95feba3f0d8ee4c20bf33f1847b56f622a27792299669e3fc912d4eeb8a8c011e3bb8df17de3cb013b8f9ec11a1c1557d248f9ae3fcc2d8383705a8efc1c4" name="bind-modules-bdbhpt-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="a13b4d9c5c006a2786b38c05aae63d346f2445bc7b31fb758df046741a2c184c97daf8a8f776d90f72c02a66001244e70d8b5fae0a3ba61d54c38043122fc3c5" name="bind-modules-generic" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="6447a47efdb015829217fee52eefe7c6cd012bea419c9863ebc4cd5967a7f386686ab08b6b91b82ab2f8fe9506dd6615ead8cf8f90ed74ba9e95bb947d90af15" name="bind-modules-generic" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="c06a45da4a64d28e71e1aa479f0a96e5ed971abb64506f29aaf0ffe40f6c20c162198d4b52b85cd60cd1a7bacfbf51524e9cb96f54dc09f121621c46bee21af0" name="bind-modules-generic-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="b8869408f3c147933702565c22319eb6101c1f52d35a812a9108cdb6f31026d23f00cf7c8f6f5ff3258751894f5aba06ca552db8b7b2f851a92df510edf82462" name="bind-modules-generic-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="f882d3b472cf3e8b795cd6bbc241e2a30b8342b9ac1f8249bdb81f869b2965e245550ca10650ed956b6e158116f75c72b1db738c4ff006cb3aa67bd7c5bfebe3" name="bind-modules-ldap" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="009839a1201e40543d6ee523c807de4e8a1e4aa9f59981ad43298eeaa6d08e2dc6d70b651f6d1d9606f1e63aa43966e7bee7df7af3f66d7ad587186aad9abc28" name="bind-modules-ldap" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="1316db1a286c866f99413fc9224c8928a6d4bda2686a08c8f6fc867a38f000ddb5bdf53d5e5b562244ee1b15116974a195e624f1a4d91b152891df813f3de824" name="bind-modules-ldap-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="af367ee18bbe24886439e5f6727b17a052daa0b59764638e4bdc68b306b42c12d980651171ec9ae1c59ef0dbc01ca9e8a322ef812adbc6de39bd4592ee30f861" name="bind-modules-ldap-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="6ea47096bd503b5e50d47ddaad8d403898927a85768743d4b350589e0c4b841ba227ae9ea788c920b621bafcbf22944b94e5207e3cae0e095cb819546fe50f83" name="bind-modules-mysql" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="de65b99ac8e0ac244a06f5a8001e7f6762ddc519b0edd6832735e81e6c5d4460db03edadcf083bff19c93937ea888a49abaf06b83e687aad7fa63672ead0cf39" name="bind-modules-mysql" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="7060443b6d497e088f1cf8ee8d76ff8a3761a9731547c807dfd534960fcc5d3db65197c7d4f7e2c65582348922aa7899a52cb452adb92c2e09c66a321130141a" name="bind-modules-mysql-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="b900c02b6feeeea3d4e4b2635c17ca6e0d669c2cb9c6df24a96afdbc1532cd80e14e6b15f9bd819e4ab324ca8c066887be74a59de82e2ac54630eda669b43b38" name="bind-modules-mysql-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="c834963563ff8a2ef828ffcadaa6d019271ec22bb8ae80461d74fde064bc203213c5a692f47fd3091afcdf4db518e1d637ffd544921cd85b501c6ce87278203d" name="bind-modules-perl" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="2191e174b9b833589a10961687297891224b34d3e442fd16ef3d57b884db44dcb6f2e905f212e0b7f5ad5323bbb666c27ea7fb8c5a94e4860de66477a85c4443" name="bind-modules-perl" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="fe051914a1185275d788d558cc555ec575337ddea88f8dc36b43b4ecf240265299c0c60fbca85cd36b615bac7323cbe63ecd4ab16dfb2bf3c8de6703a0688110" name="bind-modules-perl-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="0dedcc938141d35c7e3e3ba846bb30eb9f5210d6c2f427c3be551e9f398120bfb0e601df44c1bbe80faeab200ba1665caa71709dffa2f72ca2b78bbb2c1459c1" name="bind-modules-perl-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="0fadde0b8bb3c43247cac322985966b8a7236edf47870f102a35f7737cd926e9480c0c3565d04daa79a88484ee73284731c350df88db5c88d814067bd68760f0" name="bind-modules-sqlite3" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="ea64e98ab4555428cb7cce73bb847523f9a3983461ff85a893f1ddf372bd272363747276a3437ae41ddb9fa5cf328f6bc1f8c6a6ac1fcbf194f1a22ba625e0e1" name="bind-modules-sqlite3" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="21fbfa783679a7da02802cdf55bcd051c5e3c2b7fc6c5f3e194bffe239de0e8fac8b4093d52360733f4b48b6b745d618571bb633b9b5388af11d0ab86c43c9a7" name="bind-modules-sqlite3-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="91c672986693aff947f8974103b4ec0059fe98f7e6ab124b164af4e4b30d8582a55da2a0b3b7e5820fa4b549fcd18b9d173c7ab870dc6880f8a4601ff69eb1ee" name="bind-modules-sqlite3-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="a48d6bf76fb79a2e0903c7ae62ca34a048aed29a5f3275613e6a6b11c34fe729b6526f4e270531e004c3fdaa72ecf94caa9836967f76a57480285ca60a982a06" name="bind-utils" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="755539d0ffb14877b40dfd837f2a3af4e852ef62f03be56c5ac55f88c15c739c8a644bc4904bd1c012e052772422f4a7cd02d101a38dccdc3a04f389417dfda6" name="bind-utils" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="a9296342ad38742432ffbd72651f22bd48b42059c09ee2914a753220d529e8c3f4567bc1cc9ea47a6793d2db4df8ab3a5973fe6be8408bd99ab8a9861f81c754" name="bind-utils-debuginfo" arch="aarch64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="69019fb9f7930bc577f87b91e1b553740dd572563b8f1201caefa9dbe16e5263c8b1512977757259e227bf655992cf1229305ed7d2ae9bdea877bd5bfd235a3b" name="bind-utils-debuginfo" arch="x86_64">
  <version epoch="0" ver="9.20.24" rel="lp160.481.1"/>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1737460800">- Explicitly BuildRequire sphinx_rtd_theme.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1738238400">- Upgrade to release 9.20.5
  Security Fixes:
  * DNS-over-HTTPS flooding fixes.
    Fix DNS-over-HTTPS implementation issues that arise under heavy
    query load. Optimize resource usage for named instances that
    accept queries over DNS-over-HTTPS.
    Previously, named processed all incoming HTTP/2 data at once,
    which could overwhelm the server, especially when dealing with
    clients that sent requests but did not wait for responses. That
    has been fixed. Now, named handles HTTP/2 data in smaller
    chunks and throttles reading until the remote side reads the
    response data. It also throttles clients that send too many
    requests at once.
    In addition, named now evaluates excessive streams opened by
    clients that include no DNS data, which is considered
    “flooding.” It logs these clients and drops connections from
    them.
    In some cases, named could leave DNS-over-HTTPS connections in
    the CLOSE_WAIT state indefinitely. That has also been fixed.
    (CVE-2024-12705)
    [bsc#1236597]
  * Limit additional section processing for large RDATA sets.
    When answering queries, don’t add data to the additional
    section if the answer has more than 13 names in the RDATA. This
    limits the number of lookups into the database(s) during a
    single client query, reducing the query-processing load.
    (CVE-2024-11187)
    [bsc#1236596]
  New Features:
  * Add Extended DNS Error Code 22 - No Reachable Authority.
    When the resolver is trying to query an authoritative server
    and eventually times out, a SERVFAIL answer is given to the
    client. Add the Extended DNS Error Code 22 - No Reachable
    Authority to the response.
  * Add a new option to configure the maximum number of outgoing
    queries per client request.
    The configuration option max-query-count sets how many outgoing
    queries per client request are allowed. The existing
    max-recursion-queries value is the number of permissible
    queries for a single name and is reset on every CNAME
    redirection. This new option is a global limit on the client
    request. The default is 200.
    The default for max-recursion-queries is changed from 32 to 50.
    This allows named to send a few more queries while looking up a
    single name.
  * Use the Server Name Indication (SNI) extension for all outgoing
    TLS connections.
    This improves compatibility with other DNS server software.
  Feature Changes:
  * Performance optimization for NSEC3 lookups introduced in BIND
    9.20.2 was reverted to avoid risks associated with a complex
    code change.
  * The configuration clauses parental-agents and primaries are
    renamed to remote-servers.
    The top blocks primaries and parental-agents are no longer
    preferred and should be renamed to remote-servers. The zone
    statements parental-agents and primaries are still used, and
    may refer to any remote-servers top block.
  * Add none parameter to query-source and query-source-v6 to
    disable IPv4 or IPv6 upstream queries but allow listening to
    queries from clients on IPv4 or IPv6.
  Bug Fixes:
  * Fix nsupdate hang when processing a large update.
    To mitigate DNS flood attacks over a single TCP connection,
    throttle the connection when the other side does not read the
    data. Throttling should only occur on server-side sockets, but
    erroneously also happened for nsupdate, which acts as a client.
    When nsupdate started throttling the connection, it never
    attempted to read again. This has been fixed.
  * Fix possible assertion failure when reloading server while
    processing update policy rules.
  * Preserve cache across reconfig when using attach-cache.
    When the attach-cache option is used in the options block with
    an arbitrary name, it causes all views to use the same cache.
    Previously, this configuration caused the cache to be deleted
    and a new cache to be created every time the server was
    reconfigured. This has been fixed.
  * Resolve the spurious drops in performance due to glue cache.
    For performance reasons, the returned glue records are cached
    on the first use. The current implementation could randomly
    cause a performance drop and increased memory use. This has
    been fixed.
  * Fix dnssec-signzone signing non-DNSKEY RRsets with revoked
    keys.
    dnssec-signzone was using revoked keys for signing RRsets other
    than DNSKEY. This has been corrected.
  * Fix improper handling of unknown directives in resolv.conf.
    The line after an unknown directive in resolv.conf could
    accidentally be skipped, potentially affecting dig, host,
    nslookup, nsupdate, or delv. This has been fixed.
  * Fix response policy zones and catalog zones with an $INCLUDE
    statement defined.
    Response policy zones (RPZ) and catalog zones were not working
    correctly if they had an $INCLUDE statement defined. This has
    been fixed
- Remove desktop file and BuildRequires: update-desktop-files</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1742817600">- Upgrade to release 9.20.7
  New Features:
  * Implement the min-transfer-rate-in configuration option.
    A new option min-transfer-rate-in has been added to the view
    and zone configurations. It can abort incoming zone transfers
    that run very slowly due to network-related issues, for
    example. The default value is 10240 bytes in five minutes. [GL
    [#3914]]
  * Add HTTPS record query to host command line tool.
    The host command was extended to also query for the HTTPS RR
    type by default.
  * Implement sig0key-checks-limit and sig0message-checks-limit.
    Previously, a hard-coded limitation of a maximum of two key or
    message verification checks was introduced when checking a
    message’s SIG(0) signature, to protect against possible DoS
    attacks. Two as a maximum was chosen so that more than a single
    key should only be required during key rotations, and in that
    case two keys are enough. It later became apparent that there
    are other use cases where even more keys are required; see the
    related GitLab issue for examples.
    This change introduces two new configuration options for the
    views: sig0key-checks-limit and sig0message-checks-limit. They
    define how many keys can be checked to find a matching key, and
    how many message verifications are allowed to take place once a
    matching key has been found. The former provides slightly less
    “expensive” key parsing operations and defaults to 16. The
    latter protects against expensive cryptographic operations when
    there are keys with colliding tags and algorithm numbers; the
    default is 2. [GL #5050]
  * Adds support for EDE code 1 and 2.
    Support was added for EDE codes 1 and 2, which might occur
    during DNSSEC validation in the case of an unsupported RRSIG
    algorithm or DNSKEY digest. [GL #2715]
  * Add an rndc command to toggle jemalloc profiling.
    The new command is rndc memprof; the memory profiling status is
    also reported inside rndc status. The status shows whether
    named can toggle memory profiling, and whether the server is
    built with jemalloc. [GL #4759]
  * Add support for multiple extended DNS errors.
    The Extended DNS Error (EDE) mechanism may raise errors during
    a DNS resolution. named is now able to add up to three EDE
    codes in a DNS response. If there are duplicate error codes,
    only the first one is part of the DNS response. [GL #5085]
  * Print the expiration time of stale records.
    BIND now prints the expiration time of any stale RRsets in the
    cache dump.
  Bug Fixes:
  * Fix dual-stack-servers configuration option.
    The dual-stack-servers configuration option was not working as
    expected; the specified servers were not being used when they
    should have been, leading to resolution failures. This has been
    fixed. [GL #5019]
  * Fix a data race causing a permanent active client increase.
    Previously, a data race could cause a newly created fetch
    context for a new client to be used before it had been fully
    initialized, which would cause the query to become stuck;
    queries for the same data would be either paused indefinitely
    or dropped because of the clients-per-query limit. This has
    been fixed. [GL #5053]
  * Fix deferred validation of unsigned DS and DNSKEY records.
    When processing a query with the “checking disabled” bit set
    (CD=1), named stores the invalidated result in the cache,
    marked “pending”. When the same query is sent with CD=0, the
    cached data is validated and either accepted as an answer, or
    ejected from the cache as invalid. This deferred validation was
    not attempted for DS and DNSKEY records if they had no cached
    signatures, causing spurious validation failures. The deferred
    validation is now completed in this scenario.
    Also, if deferred validation fails, the data is now re-queried
    to find out whether the zone has been corrected since the
    invalid data was cached. [GL #5066]
  * Fix RPZ race condition during a reconfiguration.
    With RPZ in use, named could terminate unexpectedly because of
    a race condition when a reconfiguration command was received
    using rndc. This has been fixed. [GL #5146]
  * “CNAME and other data check” not applied to all types.
    An incorrect optimization caused “CNAME and other data” errors
    not to be detected if certain types were at the same node as a
    CNAME. This has been fixed. [GL #5150]
  * Relax private DNSKEY and RRSIG constraints.
    DNSKEY, KEY, RRSIG, and SIG constraints have been relaxed to
    allow empty key and signature material after the algorithm
    identifier for PRIVATEOID and PRIVATEDNS. It is arguable
    whether this falls within the expected use of these types, as
    no key material is shared and the signatures are ineffective,
    but these are private algorithms and they can be totally
    insecure. [GL #5167]
  * Remove NSEC/DS/NSEC3 RRSIG check from dns_message_parse().
    Previously, when parsing responses, named incorrectly rejected
    responses without matching RRSIG records for NSEC/DS/NSEC3
    records in the authority section. This rejection, if
    appropriate, should have been left for the validator to
    determine and has been fixed. [GL #5185]
  * Fix TTL issue with ANY queries processed through RPZ
    “passthru”.
    Answers to an “ANY” query which were processed by the RPZ
    “passthru” policy had the response-policy’s max-policy-ttl
    value unexpectedly applied. This has been fixed. [GL #5187]
  * dnssec-signzone needs to check for a NULL key when setting
    offline.
    dnssec-signzone could dereference a NULL key pointer when
    resigning a zone. This has been fixed. [GL #5192]
  * Fix a bug in the statistics channel when querying zone transfer
    information.
    When querying zone transfer information from the statistics
    channel, there was a rare possibility that named could
    terminate unexpectedly if a zone transfer was in a state when
    transferring from all the available primary servers had failed
    earlier. This has been fixed. [GL #5198]
  * Fix assertion failure when dumping recursing clients.
    Previously, if a new counter was added to the hash table while
    dumping recursing clients via the rndc recursing command, and
    fetches-per-zone was enabled, an assertion failure could occur.
    This has been fixed. [GL #5200]
  * Dump the active resolver fetches from
    dns_resolver_dumpfetches()
    Previously, active resolver fetches were only dumped when the
    fetches-per-zone configuration option was enabled. Now, active
    resolver fetches are dumped along with the number of
    clients-per-query counters per resolver fetch.
  * Recently expired records could be returned with a timestamp in
    future.
    Under rare circumstances, an RRSet that expired at the time of
    the query could be returned with a TTL in the future. This has
    been fixed.
    As a side effect, the expiration time of expired RRSets is no
    longer returned in a cache dump. [GL #5094]
  * YAML string not terminated in negative response in delv.
  * Fix a bug in dnssec-signzone related to keys being offline.
    When dnssec-signzone was called on an already-signed zone and
    the private key file was unavailable, a signature that needed
    to be refreshed was dropped without being able to generate a
    replacement. This has been fixed. [GL #5126]
  * Apply the memory limit only to ADB database items.
    Under heavy load, a resolver could exhaust the memory available
    for storing the information in the Address Database (ADB),
    effectively discarding previously stored information in the
    ADB. The memory used to retrieve and provide information from
    the ADB is no longer subject to the same memory limits that are
    applied to the Address Database. [GL #5127]
  * Avoid unnecessary locking in the zone/cache database.
    Lock contention among many worker threads referring to the same
    database node at the same time is now prevented. This improves
    zone and cache database performance for any heavily contended
    database nodes. [GL #5130]
  * Fix reporting of Extended DNS Error 22 (No Reachable
    Authority).
    This error code was previously not reported in some applicable
    situations. This has been fixed. [GL #5137]</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1743768000">- Do not build with jemalloc</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1744891200">- Upgrade to release 9.20.8
  New Features:
  * Add support for EDE 20 (Not Authoritative)
  * Add support for EDE 7 and EDE 8.
  * `dig` can now display the received BADVERS message during
    negotiation.
  * Add an `rndc` command to reset some statistics counters.
  Bug Fixes:
  * Restore NSEC3 closest-encloser lookup improvements.
  * Stop caching lack of EDNS support.
  * Fix resolver statistics counters for timed-out responses.
  * Nested DNS validation could cause an assertion failure.
  * Wait for memory reclamation to finish in `named-checkconf`.
  * Ensure `max-clients-per-query` is at least `clients-per-query`.
  * Fix write after free in validator code.
  * Don't enforce NOAUTH/NOCONF flags in DNSKEYs.
  * Fix several small DNSSEC timing issues.
  * Fix inconsistency in CNAME/DNAME handling during resolution.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1747742400">- Upgrade to release 9.20.9
  Security Fixes:
  * Prevent an assertion failure when processing TSIG algorithm.
    (CVE-2025-40775)
    [bsc#1243361]
  Feature Changes:
  * Return DNS COOKIE and NSID with BADVERS.
  * Disable separate memory context for libxml2 memory allocations
    on macOS.
  * Use Jinja2 templates in system tests.
  Bug Fixes:
  * Revert NSEC3 closest encloser lookup improvements.
  * Fix EDNS YAML output in dig.
  * Fix RDATA checks for PRIVATEOID keys.
  * Fix a serve-stale issue with a delegated zone.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1750680000">- Upgrade to release 9.20.10
  New Features:
  * Implement a new notify-defer configuration option. This new
    option sets a delay (in seconds) to wait before sending a set
    of NOTIFY messages for a zone. Whenever a NOTIFY message is
    ready to be sent, sending is deferred for this duration. This
    option should not be confused with the notify-delay option. The
    default is 0 seconds.
  Removed Features:
  * Implement the systemd notification protocol manually to remove
    dependency on libsystemd.
  Bug Fixes:
  * A secondary zone could initiate a new zone transfer from the
    primary server after it had been already deleted from the
    secondary server, and before the internal garbage collection
    was activated to clean it up completely. This has been fixed.
  * A secondary zone could fail to further refresh with new
    versions of the zone from a primary server if named was
    reconfigured during the SOA request step of an ongoing zone
    transfer. This has been fixed.
- Clean up systemd BuildRequires</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1752580800">- Upgrade to release 9.20.11
  Security Fixes:
  * Fix a possible assertion failure when
    stale-answer-client-timeout is set to 0. In specific
    circumstances the named resolver process could exit with an
    assertion failure when stale answers were enabled and the
    stale-answer-client-timeout configuration option was set to 0.
    (CVE-2025-40777)
    [bsc#1246548]
  New Features:
  * Add support for the CO flag to dig.
  Bug Fixes:
  * Correct the default interface-interval from 60s to 60m.
  * Fix a purge-keys bug when using multiple views of a zone.
  * Use IPv6 queries in delv +ns.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1755777600">- Upgrade to release 9.20.12
  New Features:
  * Support for parsing DSYNC records has been added.
  Feature Changes:
  * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS
    digest type 1.
  Bug Fixes:
  * Stale RRsets in a CNAME chain were not always refreshed.
  * Add RPZ extended DNS error for zones with a CNAME override
    policy configured.
  * Fix dig +keepopen option.
  * Log dropped or slipped responses in the query-errors category.
  * Fix synth-from-dnssec not working in some scenarios.
  * Clean enough memory when adding new ADB names/entries under
    memory pressure.
  * Prevent spurious validation failures.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1757592000">- Upgrade to release 9.20.13
  New Features:
  * Add a new option `manual-mode` to dnssec-policy.
  * Add a new option `servfail-until-ready` to response-policy
    zones.
  * Support for parsing HHIT and BRID records has been added.
  Removed Features:
  * Deprecate the `tkey-gssapi-credential` statement.
  * Obsolete the `tkey-domain` statement.
  Bug Fixes:
  * Prevent spurious SERVFAILs for certain 0-TTL resource records.
  * Fix unexpected termination if catalog-zones had undefined
    `default-primaries`.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1761134400">- Upgrade to release 9.20.15
  Security Fixes:
  * DNSSEC validation fails if matching but invalid DNSKEY is found.
    [CVE-2025-8677, bsc#1252378]
  * Address various spoofing attacks.
    [CVE-2025-40778, bsc#1252379]
  * Cache-poisoning due to weak pseudo-random number generator.
    [CVE-2025-40780, bsc#1252380]
  New Features:
  * Add dnssec-policy keys configuration check to named-checkconf.
  Bug Fixes:
  * Missing DNSSEC information when CD bit is set in query.
  * rndc sign during ZSK rollover will now replace signatures.
  * Use signer name when disabling DNSSEC algorithms.
  * Preserve cache when reload fails and reload the server again.</changelog>
  <changelog author="Jeff Mahoney &lt;jeffm@suse.com&gt;" date="1765972800">- Remove packaging support for releases prior to SLES 15 SP4/Leap 15.4.
  - The builds have dependencies that are no longer met by these older
    releases.
- Fix Sphinx processing of documentation on SLES/Leap 15.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1768996800">- Upgrade to release 9.20.18
  Security Fixes:
  * Fix incorrect length checks for BRID and HHIT records.
  (CVE-2025-13878)
  [bsc#1256997]
  Feature Changes:
  * Add more information to the rndc recursing output about
    fetches.
  * Reduce the number of outgoing queries.
  * Provide more information when memory allocation fails.
  Bug Fixes:
  * Make DNSSEC key rollovers more robust.
  * Fix a catalog zone issue, where member zones could fail to
    load.
  * Allow glue in delegations with QTYPE=ANY.
  * Fix slow speed when signing a large delegation zone with NSEC3
    opt-out.
  * Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to
    be invalid.
  * Fix a possible catalog zone issue during reconfiguration.
  * Fix the charts in the statistics channel.
  * Adding NSEC3 opt-out records could leave invalid records in
    chain.
  * Fix spurious timeouts while resolving names.
  * Fix bug where zone switches from NSEC3 to NSEC after
    retransfer.
  * AMTRELAY type 0 presentation format handling was wrong.
  * Fix parsing bug in remote-servers with key or TLS.
  * Fix DoT reconfigure/reload bug in the resolver.
  * Skip unsupported algorithms when looking for a signing key.
  * Fix dnssec-keygen key collision checking for KEY RRtype keys.
  * dnssec-verify now uses exit code 1 when failing due to illegal
    options.
  * Prevent assertion failures of dig when a server is specified
    before the -b option.
  * Skip buffer allocations if not logging.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1769601600">- Move default config files 127.0.0.zone, localhost.zone and
  root.hint in /var/lib/named to /usr/share/named with a symlink to
  /var/lib/named via systemd-tmpfiles to improve immutable os
  compatibility.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1772625600">- Update to release 9.20.20
  Security Fixes:
  * Fix a use-after-free error in dns_client_resolve() triggered by
    a DNAME response. This issue only affected the delv tool and it
    has now been fixed.
  Feature Changes:
  * Record query time for all dnstap responses.
  * Optimize TCP source port selection on Linux.
  Bug Fixes:
  * Fix an assertion failure triggered by non-minimal IXFRs.
  * Fix a crash when retrying a NOTIFY over TCP.
  * Fetch loop detection improvements.
  * Randomize nameserver selection.
  * Fix dnstap logging of forwarded queries.
  * A stale answer could have been served in case of multiple
    upstream failures when following CNAME chains. This has been
    fixed.
  * Fail DNSKEY validation when supported but invalid DS is found.
  * Importing an invalid SKR file might corrupt stack memory.
  * Return FORMERR for queries with the EDNS Client Subnet FAMILY
    field set to 0.
  * Fix inbound IXFR performance regression.
  * Make catalog zone names and member zones' entry names
    case-insensitive.
  * Fix implementation of BRID and HHIT record types.
  * Fix implementation of DSYNC record type.
  * Fix response policy and catalog zones to work with $INCLUDE
    directive.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1773316800">- Update %suse_version checks for SLES 16.x (jsc#PED-15788)</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1774526400">- Update to release 9.20.21
  Security Fixes:
  * Fix unbounded NSEC3 iterations when validating referrals to
    unsigned delegations.
    (CVE-2026-1519)
    [bsc#1260805]
  * Fix memory leaks in code preparing DNSSEC proofs of
    non-existence.
    (CVE-2026-3104)
    [bsc#1260567]
  * Prevent a crash in code processing queries containing a TKEY
    record.
    (CVE-2026-3119)
    [bsc#1260568]
  * Fix a stack use-after-return flaw in SIG(0) handling code.
    (CVE-2026-3591)
    [bsc#1260569]
  Bug Fixes:
  * Fix the handling of key statements defined inside views.</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1776081600">- Update to release 9.20.22
  Security Fixes:
  * Fix crash when reconfiguring zone update policy during active
    updates.
  Bug Fixes:
  * Fix intermittent named crashes during asynchronous zone
    operations.
  * Count temporal problems with DNSSEC validation as attempts.
  * Fix a possible deadlock in RPZ processing.
  * Fix a crash triggered by rndc modzone on a zone from a
    configuration file.
  * Fix the processing of empty catalog zone ACLs.
  * Fix a crash triggered by rndc modzone on zone that already
    existed in NZF file.
  * Fix potential resource leak during resolver error handling.</changelog>
  <changelog author="Reinhard Max &lt;max@suse.com&gt;" date="1779796800">- Upgrade to release 9.20.23
  https://downloads.isc.org/isc/bind9/9.20.23/doc/arm/html/notes.html
  Security-Fixes:
  * Amplification vulnerabilities via self-pointed glue records.
    (CVE-2026-3592)
    [bsc#1265592]
  * server memory exhaustion during GSS-API TKEY negotiation.
    (CVE-2026-3039)
    [bsc#1265591]
  * Unbounded resend loop in BIND 9 resolver
    (CVE-2026-5950)
    [bsc#1265596]
  * SIG(0) validation during query flood may lead to undefined
    behavior.
    (CVE-2026-5947)
    [bsc#1265595]
  * Invalid handling of CLASS != IN.
    (CVE-2026-5946)
    [bsc#1265594]
  * Heap use-after-free vulnerability in BIND 9 DNS-over-HTTPS
    implementation
    (CVE-2026-3593)
    [bsc#1265593]</changelog>
  <changelog author="Jorik Cronenberg &lt;jorik.cronenberg@suse.com&gt;" date="1782129600">- Upgrade to release 9.20.24
  Removed Features:
  * Remove ineffective TCP fallback after repeated UDP timeouts.
  Feature Changes:
  * Fall back to TCP on receipt of a UDP response with a mismatched
    query ID.
  * Limit the number of glue records cached from a referral.
  * Fix a resolver stall on a CNAME response to a DS query.
  Bug Fixes:
  * The resolver now removes other RRsets at the same name when
    caching a CNAME.
  * Fix nxdomain-redirect combined with dns64.
  * Fix DNS64 owner case after DNAME restart.
  * Clear REDIRECT flag when it isn't needed.
  * Disable output escaping in bind9.xsl.
  * Fix crash on badly configured secondary signer.
  * Fix a possible crash on concurrent TKEY DELETE for the same
    key.
  * Reject RRSIG records covering meta-types.</changelog>
</package>
<package pkgid="53152996ff65439f43659eda924c6838faa62b81f25c1ab13b47d8664ce451bc845d67f357eb54aba81d6991392d1ea7c5beb5ab18821221a40259a2a694eccb" name="libvarlink" arch="src">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="592fb4f0b62a251f4f7e1cb4d1a3b9bd1bc18ea323eaef3122cc3d0c7a1d6744c2fcddb67c9eb97c79879fa554d17ac8d1aad9547415910f14f5a348c76a5dbb" name="libvarlink-debugsource" arch="aarch64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="0b8e1c8839f85aa6788a9405ef5dbbef0c0931e3a0677ac4daaecfac444295769d5772913b44d9ac35fa0e8c79198b1cc81663f59ab044aadd85c747ec454556" name="libvarlink-debugsource" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="371002926281e34d1ba35f7e299f41a7ca8ad698b6f1a03b6251a84f83062f2e0272389b8b2ef05571c34f5e4f5cfdcf8858ea2e576806aee52dd5459463911f" name="libvarlink-devel" arch="aarch64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="d7e405bb492cfbf2853d6d10e6175a627803793c1d5140b672d5ec4943d93eb3f8e06a823386468e01576f16e661b9154dd1808f2328de8382f8bf6f16ec404a" name="libvarlink-devel" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="b838754e799d80f29299d0b640913cc18c64f9a21ad40849405b9b5c030c4854bcd636ea63b92cda134e5a88ba9caa5e02f79372c0bb3ec0ced8adef12443d8c" name="libvarlink0" arch="aarch64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="adc05936e7b4c176d446f087984c4ebebc0d62478d671710a316fb9facfb7882c31ae41da359a8939caa4a922bd6a6d24f8f69f284041e790294719f231ee6ca" name="libvarlink0" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="492628a67d1c17a8b6e3fd3f28291d641bbb1b3e9f59b9280c213d5cd5911bbfec732b21ab2cdaf79c42a42ae45c86183e5225f7541abbae874e0b468c1b4c54" name="libvarlink0-debuginfo" arch="aarch64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="eee23730830d9b7c31a75ebd74c6609ff27246b0e196c9b5792b1486816ad2afb7b8a757cb4148fdbe58f3863b9993447c869c04a7e53fed840d18a01532dc5e" name="libvarlink0-debuginfo" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="299e1001ce5a8c1b7bce90703b856ba42128ecb97c15447f1e6d9633b34536d79f92dff508f9fe35edd8e2fe0eb1a15acbfc6f197ddc176ec272c43036c93418" name="libvarlink0-x86-64-v3" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="8668666774e26ee288495d464d3f39ceade4658fac4736d3202d7a849f365023a73b674275fed719d06a2b9ee3a4166087e60a04a1c9eb5b329764ef67906037" name="libvarlink0-x86-64-v3-debuginfo" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="6c30a9e0b02e6b402b6bd47a98ee49c619c4af29c05f85bad540b77ef9206e3c3230af91eb45000b52bf6d2f9343388e53ed4ac6f899e0c987b21102943830d2" name="python-dnspython" arch="src">
  <version epoch="0" ver="2.7.0" rel="lp160.1.1"/>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1595073600">- remove test depending on trio, which depends on Python 3.7 if python &gt;= 3.7 is not available.</changelog>
  <changelog author="John Vandenberg &lt;jayvdb@gmail.com&gt;" date="1596715200">- Disable four tests which fail on openssl 1.1.0i and lower
- Add missing dependency requests-toolkit, and recommend
  cryptography</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607688000">- Python &lt; 3.7 requires external contextvars</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607688001">- Remove skipping tests which are acutally passing.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1610107200">- update to version 2.1.0:
  * End-of-line comments are now associated with rdata when read from text.
  For backwards compatibility with prior versions of dnspython, they are
  only emitted in to_text() when requested.
  * Synchronous I/O is a bit more efficient, as we now try the I/O and only
  use poll() or select() if the I/O would block.
  * The resolver cache classes now offer basic hit and miss statistics, and
  the LRUCache can also provide hits for every cache key.
  * The resolver has a canonical_name() method.
  * There is now a registration mechanism for EDNS option types.
  * The default EDNS payload size has changed from 1280 to 1232.
  * The SVCB, HTTPS, and SMIMEA RR types are now supported.
  * TSIG has been enhanced with TKEY and GSS-TSIG support.  Thanks to
  Nick Hall for writing this.
  * Zones now can be updated via transactions.
  * A new zone subclass, dns.versioned.Zone is available which has a
  thread-safe transaction implementation and support for keeping many
  versions of a zone.
  * The zone file reading code has been adapted to use transactions, and
  is now a public API.
  * Inbound zone transfer support has been rewritten and is available as
  dns.query.inbound_xfr() and dns.asyncquery.inbound_xfr().  It uses
  the transaction mechanism, and fully supports IXFR and AXFR.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1642507200">- update to version 2.2.0:
  - SVCB and HTTPS records have been updated to track the evolving draft standard.
  - The ZONEMD type has been added.
  - The resolver now returns a LifetimeTimeout exception which includes an error trace like the NoNameservers exception. This class is a subclass of dns.exception.Timeout for backwards compatibility.
  - DNS-over-HTTPS will try to use HTTP/2 if the httpx and h2 packages are installed.
  - DNS-over-HTTPS is now supported for asynchronous queries and resolutions.
  - dns.zonefile.read_rrsets() has been added, which allows rrsets in zonefile format, or a restrition of it, to be read. This function is useful for applications that want to read DNS data in text format, but do not want to use a Zone.
  - On Windows systems, if the WMI module is available, the resolver will retrieve the nameserver from WMI instead of trying to figure it out by reading the registry. This may lead to more accurate results in some cases.
  - The CERT rdatatype now supports certificate types IPKIX, ISPKI, IPGP, ACPKIX, and IACPKIX.
  - The CDS rdatatype now allows digest type 0.
  - Dnspython zones now enforces that a node is either a CNAME node or an “other data” node. A CNAME node contains only CNAME, RRSIG(CNAME), NSEC, RRSIG(NSEC), NSEC3, or RRSIG(NSEC3) rdatasets. An “other data” node contains any rdataset other than a CNAME or RRSIG(CNAME) rdataset. The enforcement is “last update wins”. For example, if you have a node which contains a CNAME rdataset, and then add an MX rdataset to it, then the CNAME rdataset will be deleted. Likewise if you have a node containing an MX rdataset and add a CNAME rdataset, the MX rdataset will be deleted.
  - Extended DNS Errors, as specified in RFC 8914, are now supported.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1642593600">- Update dependencies to cover all optional features and dependencies in a more structured way and describe it in the package description.</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1643803200">- Break build dependency cycle through :test multibuild
- PEP517 style: poetry-core is enough to build the package
- Clean up old python36 requirements: no longer in Tumbleweed</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1644580800">- Only recommend and not require the installation of python-h2 because it is
  seriously broken and prevents any other Python software to run correctly with -bb.
  (See also: https://github.com/python-hyper/h2/issues/1236)
  This also matches upstream's setup.py which lists h2 as optional
  dependency in extra_requires.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1647259200">- Update to version 2.2.1:
  * dns.zone.from_text failed if relativize was False and an origin was
  specified in the parameters.
  * A number of types permitted an empty "rest of the rdata".
  * L32, L64, LP, and NID were missing from dns/rdtypes/ANY/__init__.py
  * The type definition for dns.resolver.resolve_address() was incorrect.
  * dns/win32util.py erroneously had the executable bit set.
  * The type definition for a number of asynchronous query routines was
  missing the default of None for the backend parameter.
  * dns/tsigkeyring.py didn't import dns.tsig.
  * A number of rdata types that have a "rest of the line" behavior for
  the last field of the rdata erroneously permitted an empty string.
  * Timeout intervals are no longer reported with absurd precision in
  exception text.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1665403200">- Include in filelist directories with their content.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1675512000">- Update to version 2.3.0
  * The get_soa() method has been added to dns.zone.Zone.
  * The minimum TLS version is now 1.2.
  * EDNS padding is now supported. Messages with EDNS enabled and
    with a non-zero pad option will be automatically padded
    appropriately when converted to wire format.
  * dns.zone.from_text() and dns.zone.from_file() now have an
    allow_directives parameter to allow finer control over how
    directives in zonefiles are processed.
  * A preliminary implementation of DNS-over-QUIC has been added,
    and will be available if the aioquic library is present. See
    dns.query.quic(), dns.asyncquery.quic(), and examples/doq.py
    for more info. This API is subject to change in future releases
    For asynchronous I/O, both asyncio and Trio are supported,
    but Curio is not.
  * DNSSEC signing support has been added to the dns.dnssec module,
    along with a number of functions to help generate DS, CDS, and
    CDNSKEY RRsets.
  * Curio asynchronous I/O support is deprecated as of this release
    and will be removed in a future release.
  * The resolver object’s nameserver field is planned to become a
    property in dnspython 2.4. Writing to this field other than by
    direct assignment is deprecated, and so is depending on the
    mutability and form of the iterable returned when it is read.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078401">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1692705600">- update to version 2.4.2:
  * Async queries could wait forever instead of respecting the timeout if the timeout was
  0 and a packet was lost.  The timeout is now respected.
  * Restore HTTP/2 support which was accidentally broken during the https refactoring done
  as part of 2.4.0.
  * When an inception time and lifetime are specified, the signer now sets the expiration
  to the inception time plus lifetime, instead of the current time plus the lifetime.
- update to version 2.4.1:
  * Importing dns.dnssecalgs without the cryptography module installed no longer causes
  an ImportError.
  * A number of timeout bugs with the asyncio backend have been fixed.
  * DNS-over-QUIC for the asyncio backend now works for IPv6.
  * Dnspython now enforces that the candidate DNSKEYs for DNSSEC signatures
  have protocol 3 and have the ZONE flag set.  This is a standards compliance issue more
  than a security issue as the legitimate authority would have to have published
  the non-compliant keys as well as updated their DS record in order for the records
  to validate (the DS digest includes both flags and protocol).  Dnspython will not
  make invalid keys by default, but does allow them to be created and used
  for testing purposes.
  * Dependency specifications for optional features in the package metadata have been
  improved.
- update to version 2.4.0:
  * Python 3.8 or newer is required.
  * The stub resolver now uses instances of ``dns.nameserver.Nameserver`` to represent
  remote recursive resolvers, and can communicate using
  DNS over UDP/TCP, HTTPS, TLS, and QUIC.  In additional to being able to specify
  an IPv4, IPv6, or HTTPS URL as a nameserver, instances of ``dns.nameserver.Nameserver``
  are now permitted.
  * The DNS-over-HTTPS bootstrap address no longer causes URL rewriting.
  * DNS-over-HTTPS now only uses httpx; support for requests has been dropped.  A source
  port may now be supplied when using httpx.
  * DNSSEC zone signing with NSEC records is now supported. Thank you
  very much (again!) Jakob Schlyter!
  * The resolver and async resolver now have the ``try_ddr()`` method, which will try to
  use Discovery of Designated Resolvers (DDR) to upgrade the connection from the stub
  resolver to the recursive server so that it uses DNS-over-HTTPS, DNS-over-TLS, or
  DNS-over-QUIC. This feature is currently experimental as the standard is still in
  draft stage.
  * The resolver and async resolver now have the ``make_resolver_at()`` and
  ``resolve_at()`` functions, as a convenience for making queries to specific
  recursive servers.
  * Curio support has been removed.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1696507200">- Don't use curio.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1718884800">- Update to version 2.6.1
  * The Tudoor fix ate legitimate Truncated exceptions, preventing
    the resolver from failing over to TCP and causing the query to
    timeout.
- Update to version 2.6.0
  * As mentioned in the “TuDoor” paper and the associated
    CVE-2023-29483, the dnspython stub resolver is vulnerable to a
    potential DoS if a bad-in-some-way response from the right
    address and port forged by an attacker arrives before a
    legitimate one on the UDP port dnspython is using for that
    query.
    This release addresses the issue by adopting the recommended
    mitigation, which is ignoring the bad packets and continuing to
    listen for a legitimate response until the timeout for the
    query has expired.
  * Added support for the NSID EDNS option.
  * Dnspython now looks for version metadata for optional packages
    and will not use them if they are too old. This prevents
    possible exceptions when a feature like DoH is not desired in
    dnspython, but an old httpx is installed along with
    dnspython for some other purpose.
  * The DoHNameserver class now allows GET to be used instead of
    the default POST, and also passes source and source_port
    correctly to the underlying query methods.
- Update to version 2.5.0
  * Dnspython now uses hatchling for builds.
  * Cython is no longer supported due to various typing issues.
  * Dnspython now explicitly canonicalizes IPv4 and IPv6 addresses.
    Previously it was possible for non-canonical IPv6 forms to be
    stored in a AAAA address, which would work correctly but
    possibly cause problmes if the address were used as a key in a
    dictionary.
  * The number of messages in a section can be retrieved with
    section_count().
  * Truncation preferences for messages can be specified.
  * The length of a message can be automatically prepended when
    rendering.
  * dns.message.create_response() automatically adds padding when
    required by RFC 8467.
  * The TLS verify parameter is now supported by dns.query.tls(),
    and the DoH and DoT Nameserver subclasses.
  * The MutableMapping used to store content in a zone may now be
    specified by a factory when subclassing. Factories may also be
    provided for writable verisons and immutable versions.
  * dns.name.Name now has predecessor() and successor() methods
    implementing RFC 4471.
  * QUIC has had a number of bug fixes and also now supports
    session tickets for faster session resumption.
  * The NSEC3 class now has a next_name() method for retrieving the
    next name as a dns.name.Name.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728216000">- Update to version 2.7.0
  * dns.query.https() and dns.asyncquery.https() now support
    HTTP/3 and the http_version parameter may be used to specify
    which version to use.
  * If the cryptography module is installed, then dnspython will
    now create deterministic ECDSA signatures by default.
  * The RESINFO and WALLET RdataTypes are now supported.
  * The COOKIE and Report-Channel EDNS0 options are now supported.
  * All supported RdataTypes can now be imported at a single time
    rather than lazily on first use by calling
    dns.rdata.load_all_types().
  * The SVCB and HTTPS records now support the ohttp parameter.
  * xfr() and inbound_xfr() now share a common implementation.
  * Tokens are now supported for QUIC and HTTP/3.
  * dns.message.from_wire() now saves the input wire format in the
    Message’s “wire” attribute. Likewise,
    dns.message.Message.to_wire() now records the generated wire
    format in that attribute.
  * The dns.message.Message object now has a get_options() helper
    to retrieve EDNS0 options of a specified type, and an
    extended_errors() helper to retrieve the list of EDE options
    in a message (if any).
  * dns.message.make_response() now has a copy mode which controls
    how sections are copied. By default, a copy mode appropriate
    for the opcode is used.
    This is currently dns.message.CopyMode.QUESTION for all opcodes
  * If an IP address is used as the hostname in a URL, the https
    query code now passes the sni_hostname to httpx as this is
    required to get httpx to validate the certificate and check for
    an IP subject alternative name.
  * The minimum supported aioquic version is now 1.0.0.
  * The minimum supported Python version is now 3.9.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728388800">- Skip some tests
  * that require a working resolver and external DNS resolution
  * that require an openssl3 version with support for
    ECDSA with deterministic signature (RFC 6979)"</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1743681600">- Add avoid-fips-sha1-error.patch
  * Use hash.sha256() instead of hash.sha1() (which triggers error
    in fips mode);</changelog>
</package>
<package pkgid="493c72986461680309109b7acc5bde9c9d5d7a4af65508640e9865766ba5ba81707bc8317e3c904a0935771aa56e6421f4e3fa1ef54ec379c71ffcea6a73a3d5" name="python-pyasn1" arch="src">
  <version epoch="0" ver="0.6.1" rel="lp160.1.1"/>
  <changelog author="michael@stroeder.com" date="1502798400">- updated to upstream release 0.3.2
  Revision 0.3.2, released 04-08-2017
- Fixed SequenceOf/SetOf types initialization syntax to remain
  backward compatible with pyasn1 0.2.*
- Rectified thread safety issues by moving lazy, run-time computation
  into object initializer.
- Fixed .isValue property to return True for empty SetOf/SequenceOf
  objects
- Fixed GeneralizedTime/UTCTime CER/DER codecs to actually get invoked
- Fixed DER/CER encoders handling optional SEQUENCE/SET fields containing
  nested SEQUENCE/SET with optional fields.
- Fixed crash in SequenceOf/SetOf pretty printing and decoding (in some
  cases)
- Fixed documentation markup issues.</changelog>
  <changelog author="michael@stroeder.com" date="1504785600">- updated to upstream release 0.3.4
  Revision 0.3.4, released 07-09-2017
- Fixed Native encoder to handle SEQUENCE/SET objects without
  the componentType property
- Added missing component-less SEQUENCE/SET objects dict duck-typing support
- Fixed unnecessary duplicate tags detection at NamesType.tagMap
- Fixed crash at SEQUENCE and SEQUENCE OF CER encoder when running
  in schemaless mode
- Fixed Character types instantiation from OctetString type -- double
  unicode decoding may have scrambled the data
  Revision 0.3.3, released 27-08-2017
- Improved ASN.1 types instantiation performance
- Improved BER/CER/DER decoder performance by not unconditionally casting
  substrate into str/bytes.
- Fixed exponential index size growth bug when building ambiguous
  NamedTypes tree
- Fixed constructed types decoding failure at BER codec if running
  in schema-less mode
- Fixed crash on prettyPrint'ing a SEQUENCE with no defined components
- Fixed SetOf ordering at CER/DER encoder
- Fixed crash on conditional binascii module import
- Fix to TagSet hash value build</changelog>
  <changelog author="michael@stroeder.com" date="1505822400">- updated to upstream release 0.3.5
  - Codecs signatures unified and pass the options kwargs through the
    call chain
  - Explicit tag encoding optimized to avoid unnecessary copying
  - End-of-octets sentinel encoding optimized
  - Refactored ASN.1 codecs properties to silently enforce proper
    length and chunk size encoding modes
  - Fixed DER encoder to always produce primitive encoding
  - Fixed crash at SequenceOf native decoder
  - Fixed Real.prettyPrint() to fail gracefully on overflow
  - Fixed a couple of crashes when debug mode is enabled</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- updated to upstream release 0.3.6
  * End-of-octets encoding optimized at ASN.1 encoders
  * The __getitem__/__setitem__ behavior of Set/Sequence and
    SetOf/SequenceOf objects aligned with the canonical Mapping
    and Sequence protocols in part
  * Fixed crash in ASN.1 encoder when encoding an explicitly tagged
    component of a Sequence</changelog>
  <changelog author="michael@stroeder.com" date="1507809600">- updated to upstream release 0.3.7
  * Fixed ASN.1 time types pickling/deepcopy'ing</changelog>
  <changelog author="arun@gmx.de" date="1511697600">- update to version 0.4.2:
  * Fixed explicit tag splitting in chunked encoding mode at
    OctetString and BitString encoders
- changes from version 0.4.1:
  * ANY DEFINED BY clause support implemented
  * Encoders refactored to take either a value (as ASN.1 object) or a
    Python value plus ASN.1 schema
  * BitString decoder optimised for better performance when running on
    constructed encoding
  * Constructed types' .getComponentBy*() methods accept the `default`
    parameter to return instead if schema object is to be returned
  * Constructed types' .getComponentBy*() methods accept the
    `instantiate` parameter to disable automatic inner component
    instantiation
  * The ASN.1 types' `__repr__` implementation reworked for better
    readability at the cost of not being `eval`-compliant
  * Most ASN.1 types' `__str__` magic methods (except for OctetString
    and character types) reworked to call `.prettyPrint()` rather than
    `.prettyPrint` calling `__str__` as it was before. The intention
    is to eventually deprecate `.prettyPrint()` in favor of `str()`.
    The other related change is that `str()` of enumerations and
    boolean types will return string label instead of number.
  * Fixed Choice.clear() to fully reset internal state of the object
  * Sphinx documentation rearranged, simplified and reworded
  * The `isValue` singleton is now the only way to indicate ASN.1
    schema as opposed to ASN.1 schema instance. The legacy `None`
    initializer support has been removed.
  * Changed `Null` object initialization behaviour: previous default
    value (`''`) is not set anymore. Thus `Null()` call produces a
    ASN.1 schema object, while `Null('')` - value object.
  * Migrated all docs and references from SourceForge
  * Imports PEP8'ed
  * Fixed ASN.1 encoder not to omit empty substrate produced for inner
    component if the inner component belongs to the simple class (as
    opposed to constructed class)
  * Fixed CER/DER encoders to respect tagged CHOICE when ordering SET
    components
  * Fixed ASN.1 types not to interfere with the Pickle protocol
  * Fixed Sequence/SequenceOf types decoding heuristics in schema-less
    decoding mode</changelog>
  <changelog author="michael@stroeder.com" date="1527336000">- update to version 0.4.3:
  * Copyright notice extended to the year 2018
  * Fixed GeneralizedTime.asDateTime to perform
    milliseconds conversion correctly</changelog>
  <changelog author="toddrme2178@gmail.com" date="1533643200">- update to 0.4.4
  * Fixed native encoder type map to include all ASN.1 types
    rather than just ambiguous ones
  * Fixed crash in `.prettyPrint` of `Sequence` and `Set` occurring
    at OPTIONAL components</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1544184000">- Fix fdupes call</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1548676800">- update to 0.4.5
  * Debug logging refactored for more efficiency when disabled and for more
    functionality when in use. Specifically, the global LOG object can easily
    be used from any function/method, not just from codec main loop as it used
    to be.
  * More debug logging added to BER family of codecs to ease encoding problems
    troubleshooting.
  * Copyright notice extended to the year 2019
  * Fixed defaulted constructed SEQUENCE component initialization.</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1568116800">- Update to 0.4.7:
  * Many bugfixes all around, see CHANGES.rst</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1573992000">- Update to 0.4.8:
  * Added ability of combining `SingleValueConstraint` and
    `PermittedAlphabetConstraint` objects into one for proper modeling
    `FROM ... EXCEPT ...` ASN.1 clause.</changelog>
  <changelog author="pgajdos@suse.com" date="1622116800">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1683201600">- update to 0.5.0:
  * Change `RealEncoder.supportIndefLenMode` type to a boolean
  * Fix CI for py39 test environment
  * Replace all snmplabs.com links
  * Use correct SPDX identifier for the license
  * Re-add ``tagMap`` and ``typeMap`` module level attributes to all
    encoder and decoder modules. They are aliases for ``TAG_MAP`` and
    ``TYPE_MAP``
  * Restore API for passing for ``tagMap`` and ``typeMap`` arguments
    to ``Encoder`` and ``Decoder`` classes by name and position,
  * Re-add ``tagMap`` and ``typeMap`` module level attributes to all
    encoder and decoder modules. They are aliases for ``TAG_MAP`` and
  ``TYPE_MAP``
  * Restore API for passing for ``tagMap`` and ``typeMap`` arguments
    to ``Encoder`` and ``Decoder`` classes by name and position,
  * Make BER/CER/DER decoders streaming and suspendible</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1701086400">- update to 0.5.1:
  * Added support for PyPy 3.10 and Python 3.12
  * Updated RTD configuration to include a dummy index.rst
    redirecting to contents.html, ensuring compatibility with
    third-party documentation and search indexes.
  * Fixed the API breakage wih decoder.decode(substrateFun=...).
  * A substrateFun passed to ``decoder.decode()`` can now be
    either v0.4 Non-Streaming or v0.5 Streaming.
    pyasn1 will detect and handle both cases transparently.
  * A substrateFun passed to one of the new streaming decoders is
  * still expected to be v0.5 Streaming only.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1712145600">- update to 0.6.0:
  * Added support for previously missing RELATIVE-OID construct
  * Updated link to Layman's Guide Now it provides a link to
    links to a formatted PDF version of the paper, at a stable
    domain (researchgate), using https
  * Removed support for EOL Python 2.7, 3.6, 3.7</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715774400">- Fix regressions dealing component == None; Add patch
  0001-pyasn1-coded-ber-Fix-regressions-dealing-component-N.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1728302400">- Update to 0.6.1
  * Added support for Python 3.13 and updated GitHub Actions
  * Removed Python 2 support and related code
  * Improved error handling and consistency
  * Runtime deprecation of `tagMap` and `typeMap` aliases
  * Fixed duplicated and missing declarations
  * Cleaned documentation and comments
  * Removed bdist_wheel universal flag from setup.cfg</changelog>
</package>
<package pkgid="54ab3c35614ee563db8715e42c1f9dae286e1156e665f856f180edbb6890f3c819aeaf942f5f6bb1f6e1b95984e8b9e3055ec14beed03252e1f6656729bacfab" name="python-varlink" arch="src">
  <version epoch="0" ver="31.0.0" rel="lp160.12.1"/>
  <changelog author="Thomas Bechtold &lt;tbechtold@suse.com&gt;" date="1561636800">- Initial packaging (version 30.1.2)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1561896000">- Update descriptions.</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1568635200">- Update to 30.3.0:
  * no upstream changelog</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1641816000">- update to 31.0.0:
  * fix tests
  * remove python 3.4, 3.5
  * fix(scanner): compat code
  * fix: reduce test-requirements.txt</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1693915200">- Switch to pyproject macros.
- Stop using greedy globs in %files.
- Drop unneeded {Build,}Requires on future.</changelog>
</package>
<package pkgid="777b9b78c9e1f8329b0ff616aaea0b3e7faedceda05f295fbcff2d7bd9dac9f3f4bce29e42241af9d0bc08adb943a1d4ed51e9ea730c8c550db62e4a93cc8625" name="python313-dnspython" arch="noarch">
  <version epoch="0" ver="2.7.0" rel="lp160.1.1"/>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1595073600">- remove test depending on trio, which depends on Python 3.7 if python &gt;= 3.7 is not available.</changelog>
  <changelog author="John Vandenberg &lt;jayvdb@gmail.com&gt;" date="1596715200">- Disable four tests which fail on openssl 1.1.0i and lower
- Add missing dependency requests-toolkit, and recommend
  cryptography</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607688000">- Python &lt; 3.7 requires external contextvars</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607688001">- Remove skipping tests which are acutally passing.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1610107200">- update to version 2.1.0:
  * End-of-line comments are now associated with rdata when read from text.
  For backwards compatibility with prior versions of dnspython, they are
  only emitted in to_text() when requested.
  * Synchronous I/O is a bit more efficient, as we now try the I/O and only
  use poll() or select() if the I/O would block.
  * The resolver cache classes now offer basic hit and miss statistics, and
  the LRUCache can also provide hits for every cache key.
  * The resolver has a canonical_name() method.
  * There is now a registration mechanism for EDNS option types.
  * The default EDNS payload size has changed from 1280 to 1232.
  * The SVCB, HTTPS, and SMIMEA RR types are now supported.
  * TSIG has been enhanced with TKEY and GSS-TSIG support.  Thanks to
  Nick Hall for writing this.
  * Zones now can be updated via transactions.
  * A new zone subclass, dns.versioned.Zone is available which has a
  thread-safe transaction implementation and support for keeping many
  versions of a zone.
  * The zone file reading code has been adapted to use transactions, and
  is now a public API.
  * Inbound zone transfer support has been rewritten and is available as
  dns.query.inbound_xfr() and dns.asyncquery.inbound_xfr().  It uses
  the transaction mechanism, and fully supports IXFR and AXFR.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1642507200">- update to version 2.2.0:
  - SVCB and HTTPS records have been updated to track the evolving draft standard.
  - The ZONEMD type has been added.
  - The resolver now returns a LifetimeTimeout exception which includes an error trace like the NoNameservers exception. This class is a subclass of dns.exception.Timeout for backwards compatibility.
  - DNS-over-HTTPS will try to use HTTP/2 if the httpx and h2 packages are installed.
  - DNS-over-HTTPS is now supported for asynchronous queries and resolutions.
  - dns.zonefile.read_rrsets() has been added, which allows rrsets in zonefile format, or a restrition of it, to be read. This function is useful for applications that want to read DNS data in text format, but do not want to use a Zone.
  - On Windows systems, if the WMI module is available, the resolver will retrieve the nameserver from WMI instead of trying to figure it out by reading the registry. This may lead to more accurate results in some cases.
  - The CERT rdatatype now supports certificate types IPKIX, ISPKI, IPGP, ACPKIX, and IACPKIX.
  - The CDS rdatatype now allows digest type 0.
  - Dnspython zones now enforces that a node is either a CNAME node or an “other data” node. A CNAME node contains only CNAME, RRSIG(CNAME), NSEC, RRSIG(NSEC), NSEC3, or RRSIG(NSEC3) rdatasets. An “other data” node contains any rdataset other than a CNAME or RRSIG(CNAME) rdataset. The enforcement is “last update wins”. For example, if you have a node which contains a CNAME rdataset, and then add an MX rdataset to it, then the CNAME rdataset will be deleted. Likewise if you have a node containing an MX rdataset and add a CNAME rdataset, the MX rdataset will be deleted.
  - Extended DNS Errors, as specified in RFC 8914, are now supported.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1642593600">- Update dependencies to cover all optional features and dependencies in a more structured way and describe it in the package description.</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1643803200">- Break build dependency cycle through :test multibuild
- PEP517 style: poetry-core is enough to build the package
- Clean up old python36 requirements: no longer in Tumbleweed</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1644580800">- Only recommend and not require the installation of python-h2 because it is
  seriously broken and prevents any other Python software to run correctly with -bb.
  (See also: https://github.com/python-hyper/h2/issues/1236)
  This also matches upstream's setup.py which lists h2 as optional
  dependency in extra_requires.</changelog>
  <changelog author="Sebastian Wagner &lt;sebix+novell.com@sebix.at&gt;" date="1647259200">- Update to version 2.2.1:
  * dns.zone.from_text failed if relativize was False and an origin was
  specified in the parameters.
  * A number of types permitted an empty "rest of the rdata".
  * L32, L64, LP, and NID were missing from dns/rdtypes/ANY/__init__.py
  * The type definition for dns.resolver.resolve_address() was incorrect.
  * dns/win32util.py erroneously had the executable bit set.
  * The type definition for a number of asynchronous query routines was
  missing the default of None for the backend parameter.
  * dns/tsigkeyring.py didn't import dns.tsig.
  * A number of rdata types that have a "rest of the line" behavior for
  the last field of the rdata erroneously permitted an empty string.
  * Timeout intervals are no longer reported with absurd precision in
  exception text.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1665403200">- Include in filelist directories with their content.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1675512000">- Update to version 2.3.0
  * The get_soa() method has been added to dns.zone.Zone.
  * The minimum TLS version is now 1.2.
  * EDNS padding is now supported. Messages with EDNS enabled and
    with a non-zero pad option will be automatically padded
    appropriately when converted to wire format.
  * dns.zone.from_text() and dns.zone.from_file() now have an
    allow_directives parameter to allow finer control over how
    directives in zonefiles are processed.
  * A preliminary implementation of DNS-over-QUIC has been added,
    and will be available if the aioquic library is present. See
    dns.query.quic(), dns.asyncquery.quic(), and examples/doq.py
    for more info. This API is subject to change in future releases
    For asynchronous I/O, both asyncio and Trio are supported,
    but Curio is not.
  * DNSSEC signing support has been added to the dns.dnssec module,
    along with a number of functions to help generate DS, CDS, and
    CDNSKEY RRsets.
  * Curio asynchronous I/O support is deprecated as of this release
    and will be removed in a future release.
  * The resolver object’s nameserver field is planned to become a
    property in dnspython 2.4. Writing to this field other than by
    direct assignment is deprecated, and so is depending on the
    mutability and form of the iterable returned when it is read.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078401">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Sebastian Wagner &lt;sebix@sebix.at&gt;" date="1692705600">- update to version 2.4.2:
  * Async queries could wait forever instead of respecting the timeout if the timeout was
  0 and a packet was lost.  The timeout is now respected.
  * Restore HTTP/2 support which was accidentally broken during the https refactoring done
  as part of 2.4.0.
  * When an inception time and lifetime are specified, the signer now sets the expiration
  to the inception time plus lifetime, instead of the current time plus the lifetime.
- update to version 2.4.1:
  * Importing dns.dnssecalgs without the cryptography module installed no longer causes
  an ImportError.
  * A number of timeout bugs with the asyncio backend have been fixed.
  * DNS-over-QUIC for the asyncio backend now works for IPv6.
  * Dnspython now enforces that the candidate DNSKEYs for DNSSEC signatures
  have protocol 3 and have the ZONE flag set.  This is a standards compliance issue more
  than a security issue as the legitimate authority would have to have published
  the non-compliant keys as well as updated their DS record in order for the records
  to validate (the DS digest includes both flags and protocol).  Dnspython will not
  make invalid keys by default, but does allow them to be created and used
  for testing purposes.
  * Dependency specifications for optional features in the package metadata have been
  improved.
- update to version 2.4.0:
  * Python 3.8 or newer is required.
  * The stub resolver now uses instances of ``dns.nameserver.Nameserver`` to represent
  remote recursive resolvers, and can communicate using
  DNS over UDP/TCP, HTTPS, TLS, and QUIC.  In additional to being able to specify
  an IPv4, IPv6, or HTTPS URL as a nameserver, instances of ``dns.nameserver.Nameserver``
  are now permitted.
  * The DNS-over-HTTPS bootstrap address no longer causes URL rewriting.
  * DNS-over-HTTPS now only uses httpx; support for requests has been dropped.  A source
  port may now be supplied when using httpx.
  * DNSSEC zone signing with NSEC records is now supported. Thank you
  very much (again!) Jakob Schlyter!
  * The resolver and async resolver now have the ``try_ddr()`` method, which will try to
  use Discovery of Designated Resolvers (DDR) to upgrade the connection from the stub
  resolver to the recursive server so that it uses DNS-over-HTTPS, DNS-over-TLS, or
  DNS-over-QUIC. This feature is currently experimental as the standard is still in
  draft stage.
  * The resolver and async resolver now have the ``make_resolver_at()`` and
  ``resolve_at()`` functions, as a convenience for making queries to specific
  recursive servers.
  * Curio support has been removed.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1696507200">- Don't use curio.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1718884800">- Update to version 2.6.1
  * The Tudoor fix ate legitimate Truncated exceptions, preventing
    the resolver from failing over to TCP and causing the query to
    timeout.
- Update to version 2.6.0
  * As mentioned in the “TuDoor” paper and the associated
    CVE-2023-29483, the dnspython stub resolver is vulnerable to a
    potential DoS if a bad-in-some-way response from the right
    address and port forged by an attacker arrives before a
    legitimate one on the UDP port dnspython is using for that
    query.
    This release addresses the issue by adopting the recommended
    mitigation, which is ignoring the bad packets and continuing to
    listen for a legitimate response until the timeout for the
    query has expired.
  * Added support for the NSID EDNS option.
  * Dnspython now looks for version metadata for optional packages
    and will not use them if they are too old. This prevents
    possible exceptions when a feature like DoH is not desired in
    dnspython, but an old httpx is installed along with
    dnspython for some other purpose.
  * The DoHNameserver class now allows GET to be used instead of
    the default POST, and also passes source and source_port
    correctly to the underlying query methods.
- Update to version 2.5.0
  * Dnspython now uses hatchling for builds.
  * Cython is no longer supported due to various typing issues.
  * Dnspython now explicitly canonicalizes IPv4 and IPv6 addresses.
    Previously it was possible for non-canonical IPv6 forms to be
    stored in a AAAA address, which would work correctly but
    possibly cause problmes if the address were used as a key in a
    dictionary.
  * The number of messages in a section can be retrieved with
    section_count().
  * Truncation preferences for messages can be specified.
  * The length of a message can be automatically prepended when
    rendering.
  * dns.message.create_response() automatically adds padding when
    required by RFC 8467.
  * The TLS verify parameter is now supported by dns.query.tls(),
    and the DoH and DoT Nameserver subclasses.
  * The MutableMapping used to store content in a zone may now be
    specified by a factory when subclassing. Factories may also be
    provided for writable verisons and immutable versions.
  * dns.name.Name now has predecessor() and successor() methods
    implementing RFC 4471.
  * QUIC has had a number of bug fixes and also now supports
    session tickets for faster session resumption.
  * The NSEC3 class now has a next_name() method for retrieving the
    next name as a dns.name.Name.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728216000">- Update to version 2.7.0
  * dns.query.https() and dns.asyncquery.https() now support
    HTTP/3 and the http_version parameter may be used to specify
    which version to use.
  * If the cryptography module is installed, then dnspython will
    now create deterministic ECDSA signatures by default.
  * The RESINFO and WALLET RdataTypes are now supported.
  * The COOKIE and Report-Channel EDNS0 options are now supported.
  * All supported RdataTypes can now be imported at a single time
    rather than lazily on first use by calling
    dns.rdata.load_all_types().
  * The SVCB and HTTPS records now support the ohttp parameter.
  * xfr() and inbound_xfr() now share a common implementation.
  * Tokens are now supported for QUIC and HTTP/3.
  * dns.message.from_wire() now saves the input wire format in the
    Message’s “wire” attribute. Likewise,
    dns.message.Message.to_wire() now records the generated wire
    format in that attribute.
  * The dns.message.Message object now has a get_options() helper
    to retrieve EDNS0 options of a specified type, and an
    extended_errors() helper to retrieve the list of EDE options
    in a message (if any).
  * dns.message.make_response() now has a copy mode which controls
    how sections are copied. By default, a copy mode appropriate
    for the opcode is used.
    This is currently dns.message.CopyMode.QUESTION for all opcodes
  * If an IP address is used as the hostname in a URL, the https
    query code now passes the sni_hostname to httpx as this is
    required to get httpx to validate the certificate and check for
    an IP subject alternative name.
  * The minimum supported aioquic version is now 1.0.0.
  * The minimum supported Python version is now 3.9.</changelog>
  <changelog author="Martin Hauke &lt;mardnh@gmx.de&gt;" date="1728388800">- Skip some tests
  * that require a working resolver and external DNS resolution
  * that require an openssl3 version with support for
    ECDSA with deterministic signature (RFC 6979)"</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1743681600">- Add avoid-fips-sha1-error.patch
  * Use hash.sha256() instead of hash.sha1() (which triggers error
    in fips mode);</changelog>
</package>
<package pkgid="07208e94232c555eb0fcb3ad01586ba61bfb183af5764d108d4710ee6f293ea857edf3b4285da40afe71c1bd2a77c8adf3bb3b27ea1491f96ffbe6dd1c75ee7d" name="python313-pyasn1" arch="noarch">
  <version epoch="0" ver="0.6.1" rel="lp160.1.1"/>
  <changelog author="michael@stroeder.com" date="1502798400">- updated to upstream release 0.3.2
  Revision 0.3.2, released 04-08-2017
- Fixed SequenceOf/SetOf types initialization syntax to remain
  backward compatible with pyasn1 0.2.*
- Rectified thread safety issues by moving lazy, run-time computation
  into object initializer.
- Fixed .isValue property to return True for empty SetOf/SequenceOf
  objects
- Fixed GeneralizedTime/UTCTime CER/DER codecs to actually get invoked
- Fixed DER/CER encoders handling optional SEQUENCE/SET fields containing
  nested SEQUENCE/SET with optional fields.
- Fixed crash in SequenceOf/SetOf pretty printing and decoding (in some
  cases)
- Fixed documentation markup issues.</changelog>
  <changelog author="michael@stroeder.com" date="1504785600">- updated to upstream release 0.3.4
  Revision 0.3.4, released 07-09-2017
- Fixed Native encoder to handle SEQUENCE/SET objects without
  the componentType property
- Added missing component-less SEQUENCE/SET objects dict duck-typing support
- Fixed unnecessary duplicate tags detection at NamesType.tagMap
- Fixed crash at SEQUENCE and SEQUENCE OF CER encoder when running
  in schemaless mode
- Fixed Character types instantiation from OctetString type -- double
  unicode decoding may have scrambled the data
  Revision 0.3.3, released 27-08-2017
- Improved ASN.1 types instantiation performance
- Improved BER/CER/DER decoder performance by not unconditionally casting
  substrate into str/bytes.
- Fixed exponential index size growth bug when building ambiguous
  NamedTypes tree
- Fixed constructed types decoding failure at BER codec if running
  in schema-less mode
- Fixed crash on prettyPrint'ing a SEQUENCE with no defined components
- Fixed SetOf ordering at CER/DER encoder
- Fixed crash on conditional binascii module import
- Fix to TagSet hash value build</changelog>
  <changelog author="michael@stroeder.com" date="1505822400">- updated to upstream release 0.3.5
  - Codecs signatures unified and pass the options kwargs through the
    call chain
  - Explicit tag encoding optimized to avoid unnecessary copying
  - End-of-octets sentinel encoding optimized
  - Refactored ASN.1 codecs properties to silently enforce proper
    length and chunk size encoding modes
  - Fixed DER encoder to always produce primitive encoding
  - Fixed crash at SequenceOf native decoder
  - Fixed Real.prettyPrint() to fail gracefully on overflow
  - Fixed a couple of crashes when debug mode is enabled</changelog>
  <changelog author="michael@stroeder.com" date="1505995200">- updated to upstream release 0.3.6
  * End-of-octets encoding optimized at ASN.1 encoders
  * The __getitem__/__setitem__ behavior of Set/Sequence and
    SetOf/SequenceOf objects aligned with the canonical Mapping
    and Sequence protocols in part
  * Fixed crash in ASN.1 encoder when encoding an explicitly tagged
    component of a Sequence</changelog>
  <changelog author="michael@stroeder.com" date="1507809600">- updated to upstream release 0.3.7
  * Fixed ASN.1 time types pickling/deepcopy'ing</changelog>
  <changelog author="arun@gmx.de" date="1511697600">- update to version 0.4.2:
  * Fixed explicit tag splitting in chunked encoding mode at
    OctetString and BitString encoders
- changes from version 0.4.1:
  * ANY DEFINED BY clause support implemented
  * Encoders refactored to take either a value (as ASN.1 object) or a
    Python value plus ASN.1 schema
  * BitString decoder optimised for better performance when running on
    constructed encoding
  * Constructed types' .getComponentBy*() methods accept the `default`
    parameter to return instead if schema object is to be returned
  * Constructed types' .getComponentBy*() methods accept the
    `instantiate` parameter to disable automatic inner component
    instantiation
  * The ASN.1 types' `__repr__` implementation reworked for better
    readability at the cost of not being `eval`-compliant
  * Most ASN.1 types' `__str__` magic methods (except for OctetString
    and character types) reworked to call `.prettyPrint()` rather than
    `.prettyPrint` calling `__str__` as it was before. The intention
    is to eventually deprecate `.prettyPrint()` in favor of `str()`.
    The other related change is that `str()` of enumerations and
    boolean types will return string label instead of number.
  * Fixed Choice.clear() to fully reset internal state of the object
  * Sphinx documentation rearranged, simplified and reworded
  * The `isValue` singleton is now the only way to indicate ASN.1
    schema as opposed to ASN.1 schema instance. The legacy `None`
    initializer support has been removed.
  * Changed `Null` object initialization behaviour: previous default
    value (`''`) is not set anymore. Thus `Null()` call produces a
    ASN.1 schema object, while `Null('')` - value object.
  * Migrated all docs and references from SourceForge
  * Imports PEP8'ed
  * Fixed ASN.1 encoder not to omit empty substrate produced for inner
    component if the inner component belongs to the simple class (as
    opposed to constructed class)
  * Fixed CER/DER encoders to respect tagged CHOICE when ordering SET
    components
  * Fixed ASN.1 types not to interfere with the Pickle protocol
  * Fixed Sequence/SequenceOf types decoding heuristics in schema-less
    decoding mode</changelog>
  <changelog author="michael@stroeder.com" date="1527336000">- update to version 0.4.3:
  * Copyright notice extended to the year 2018
  * Fixed GeneralizedTime.asDateTime to perform
    milliseconds conversion correctly</changelog>
  <changelog author="toddrme2178@gmail.com" date="1533643200">- update to 0.4.4
  * Fixed native encoder type map to include all ASN.1 types
    rather than just ambiguous ones
  * Fixed crash in `.prettyPrint` of `Sequence` and `Set` occurring
    at OPTIONAL components</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1544184000">- Fix fdupes call</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1548676800">- update to 0.4.5
  * Debug logging refactored for more efficiency when disabled and for more
    functionality when in use. Specifically, the global LOG object can easily
    be used from any function/method, not just from codec main loop as it used
    to be.
  * More debug logging added to BER family of codecs to ease encoding problems
    troubleshooting.
  * Copyright notice extended to the year 2019
  * Fixed defaulted constructed SEQUENCE component initialization.</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1568116800">- Update to 0.4.7:
  * Many bugfixes all around, see CHANGES.rst</changelog>
  <changelog author="Michael Str&#xF6;der &lt;michael@stroeder.com&gt;" date="1573992000">- Update to 0.4.8:
  * Added ability of combining `SingleValueConstraint` and
    `PermittedAlphabetConstraint` objects into one for proper modeling
    `FROM ... EXCEPT ...` ASN.1 clause.</changelog>
  <changelog author="pgajdos@suse.com" date="1622116800">- %check: use %pyunittest rpm macro</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1681387200">- Make calling of %{sle15modernpython} optional.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1682078400">- add sle15_python_module_pythons (jsc#PED-68)</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1683201600">- update to 0.5.0:
  * Change `RealEncoder.supportIndefLenMode` type to a boolean
  * Fix CI for py39 test environment
  * Replace all snmplabs.com links
  * Use correct SPDX identifier for the license
  * Re-add ``tagMap`` and ``typeMap`` module level attributes to all
    encoder and decoder modules. They are aliases for ``TAG_MAP`` and
    ``TYPE_MAP``
  * Restore API for passing for ``tagMap`` and ``typeMap`` arguments
    to ``Encoder`` and ``Decoder`` classes by name and position,
  * Re-add ``tagMap`` and ``typeMap`` module level attributes to all
    encoder and decoder modules. They are aliases for ``TAG_MAP`` and
  ``TYPE_MAP``
  * Restore API for passing for ``tagMap`` and ``typeMap`` arguments
    to ``Encoder`` and ``Decoder`` classes by name and position,
  * Make BER/CER/DER decoders streaming and suspendible</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1701086400">- update to 0.5.1:
  * Added support for PyPy 3.10 and Python 3.12
  * Updated RTD configuration to include a dummy index.rst
    redirecting to contents.html, ensuring compatibility with
    third-party documentation and search indexes.
  * Fixed the API breakage wih decoder.decode(substrateFun=...).
  * A substrateFun passed to ``decoder.decode()`` can now be
    either v0.4 Non-Streaming or v0.5 Streaming.
    pyasn1 will detect and handle both cases transparently.
  * A substrateFun passed to one of the new streaming decoders is
  * still expected to be v0.5 Streaming only.</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1712145600">- update to 0.6.0:
  * Added support for previously missing RELATIVE-OID construct
  * Updated link to Layman's Guide Now it provides a link to
    links to a formatted PDF version of the paper, at a stable
    domain (researchgate), using https
  * Removed support for EOL Python 2.7, 3.6, 3.7</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715774400">- Fix regressions dealing component == None; Add patch
  0001-pyasn1-coded-ber-Fix-regressions-dealing-component-N.patch</changelog>
  <changelog author="John Paul Adrian Glaubitz &lt;adrian.glaubitz@suse.com&gt;" date="1728302400">- Update to 0.6.1
  * Added support for Python 3.13 and updated GitHub Actions
  * Removed Python 2 support and related code
  * Improved error handling and consistency
  * Runtime deprecation of `tagMap` and `typeMap` aliases
  * Fixed duplicated and missing declarations
  * Cleaned documentation and comments
  * Removed bdist_wheel universal flag from setup.cfg</changelog>
</package>
<package pkgid="ee542b322069d1ee77e36f3c41e085eda02add7cb996da829978f88ee4ae0c82d1b37798d9ee7fda2fab2733d23a7537bacb71469a36d9f4b52869a0956ec6a3" name="python313-varlink" arch="noarch">
  <version epoch="0" ver="31.0.0" rel="lp160.12.1"/>
  <changelog author="Thomas Bechtold &lt;tbechtold@suse.com&gt;" date="1561636800">- Initial packaging (version 30.1.2)</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1561896000">- Update descriptions.</changelog>
  <changelog author="Tom&#xE1;&#x161; Chv&#xE1;tal &lt;tchvatal@suse.com&gt;" date="1568635200">- Update to 30.3.0:
  * no upstream changelog</changelog>
  <changelog author="Dirk M&#xFC;ller &lt;dmueller@suse.com&gt;" date="1641816000">- update to 31.0.0:
  * fix tests
  * remove python 3.4, 3.5
  * fix(scanner): compat code
  * fix: reduce test-requirements.txt</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1693915200">- Switch to pyproject macros.
- Stop using greedy globs in %files.
- Drop unneeded {Build,}Requires on future.</changelog>
</package>
<package pkgid="05c3c9baf33494d77081d6faf39bc499ebcd2a32aef89340f717a3565c248b908f6014646821eb7f4c2a628f80cc894433b90376956e0597a1d296ad2cfdee6c" name="varlink-bash-completion" arch="noarch">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="289066db4e1c9deaa9805a8f261502b012b3545f2f45e3e60a11f0b2182feaf5a210e46dd7cb65bed600395da3303dd5d73ea25561f7c3433c8c9a87e0d8911f" name="varlink-util" arch="aarch64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="9f456e9a04aed7a3c4ff2ea9c50650fab93ef05790e9958b8b6c9fa0359a7c51803c6f2792242a39c476c0eaaaacad436b63e4cd78fe7759d58cb4e5cf2bb5e6" name="varlink-util" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="2628afc7f4538aff63d35b8c9ffaa707d64f64f84a0e7d01537bc2ea5c48396e87cc382c31bb901f9a97ff8a14fa6c8a367a8418939263cc2f27e59aea5a53f2" name="varlink-util-debuginfo" arch="aarch64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="46a64583928421ee8ee400ceef1d87bde726ba97eb669be0d4eee47cf27f20a7fd8f9bb8bf7ee8f94e2b05234a80ceaeb9c55ed3742b4124a6fe9e38ccac65cc" name="varlink-util-debuginfo" arch="x86_64">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
<package pkgid="9dfbdb6c68763e7262e3151e2fe9e8874f83b82f8294a362d363e527bfde7347427dd863322d4ea83255c27a00f564cc8ebe9f79bd8f67e3ff173f8a9eea39e6" name="varlink-vim" arch="noarch">
  <version epoch="0" ver="24" rel="lp160.16.1"/>
  <changelog author="Micha&#x142; Rostecki &lt;mrostecki@opensuse.org&gt;" date="1549368000">- Inital release 16</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1549368001">- Update descriptions</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1711195200">- Update to release 23. Changes since 16:
  * fixed build with musl
  * use env for python3 path
  * don't drop bytes in varlink bridge
  * compile with clang and musl-gcc
  * correct issues pointed out by static code analysis
  * use strtod_l
  * return VARLINK_ERROR_PANIC on float Inf or NaN
  * correct the float number parsing for some locales
  * libvarlink now includes and passes most of the JSONTestSuite tests.
  * allow uppercase letters in interface names
- Update descriptions and summary
- Add subpackages
  * vim subpackage
  * bash completion
  * util subpackage that contains the `varlink` binary</changelog>
  <changelog author="Jan Engelhardt &lt;jengelh@inai.de&gt;" date="1713873600">- Restore neutrality of descriptions, and trim for size. Remove
  hard require on *-bash-completion. Remove _service git puller
  because since v23, a tarball URL is used.</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716120000">- Add tests
- Remove supplements section
- Add baselibs.conf</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811200">- Change names to a non-lib name. This avoids confusion
  if the installed subpackages are libraries or not</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716811201">- Add varlink-bash-completion as recommends in varlink-utils</changelog>
  <changelog author="Soc Virnyl Estela &lt;uncomfy+openbuildservice@uncomfyhalomacro.pl&gt;" date="1716897600">- Apply suggestion and fix mistakes for varlink-bash-completions
  * supplements bash-completion and varlink-util
  * requires varlink-util in devel package</changelog>
  <changelog author="Andreas Schneider &lt;asn@cryptomilk.org&gt;" date="1737115200">- Update to version 24</changelog>
</package>
</otherdata>