SUSE-SU-2022:3767-1: important: Recommended update for bind

sle-updates at lists.suse.com sle-updates at lists.suse.com
Wed Oct 26 13:27:06 UTC 2022


   SUSE Security Update: Recommended update for bind
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:3767-1
Rating:             important
References:         #1201689 #1203250 #1203614 #1203618 #1203619 
                    #1203620 SLE-24600 
Cross-References:   CVE-2022-2795 CVE-2022-3080 CVE-2022-38177
                    CVE-2022-38178
CVSS scores:
                    CVE-2022-2795 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-2795 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-3080 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-3080 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-38177 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-38177 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-38178 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2022-38178 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE Linux Enterprise Desktop 15-SP4
                    SUSE Linux Enterprise High Performance Computing 15-SP4
                    SUSE Linux Enterprise Module for Basesystem 15-SP4
                    SUSE Linux Enterprise Module for Server Applications 15-SP4
                    SUSE Linux Enterprise Server 15-SP4
                    SUSE Linux Enterprise Server for SAP Applications 15-SP4
                    SUSE Manager Proxy 4.3
                    SUSE Manager Retail Branch Server 4.3
                    SUSE Manager Server 4.3
                    openSUSE Leap 15.4
______________________________________________________________________________

   An update that solves four vulnerabilities, contains one
   feature and has two fixes is now available.

Description:

   This update for bind fixes the following issues:

   Update to release 9.16.33:

   - CVE-2022-2795: Fixed potential performance degredation due to missing
     database lookup limits when processing large delegations (bsc#1203614).
   - CVE-2022-3080: Fixed assertion failure when there was a stale CNAME in
     the cache for the incoming query and the stale-answer-client-timeout
     option is set to 0 (bsc#1203618).
   - CVE-2022-38177: Fixed a memory leak that could be externally triggered
     in the DNSSEC verification code for the ECDSA algorithm (bsc#1203619).
   - CVE-2022-38178: Fixed memory leaks that could be externally triggered in
     the DNSSEC verification code for the EdDSA algorithm (bsc#1203620).

   - Add systemd drop-in directory for named service (bsc#1201689).
   - Add modified createNamedConfInclude script and README-bind.chrootenv
     (bsc#1203250).

   - Feature Changes:
     - Response Rate Limiting (RRL) code now treats all QNAMEs that are
       subject to wildcard processing within a given zone as the same name,
       to prevent circumventing the limits enforced by RRL.

     - Zones using dnssec-policy now require dynamic DNS or inline-signing to
       be configured explicitly.

     - A backward-compatible approach was implemented for encoding
       internationalized domain names (IDN) in dig and converting the domain
       to IDNA2008 form; if that fails, BIND tries an IDNA2003 conversion.

     - The DNSSEC algorithms RSASHA1 and NSEC3RSASHA1 are now automatically
       disabled on systems where they are disallowed by the security policy.
       Primary zones using those algorithms need to be migrated to new
       algorithms prior to running on these systems, as graceful migration to
       different DNSSEC algorithms is not possible when RSASHA1 is disallowed
       by the operating system.

     - Log messages related to fetch limiting have been improved to provide
       more complete information. Specifically, the final counts of allowed
       and spilled fetches are now logged before the counter object is
       destroyed.

     - Non-dynamic zones that inherit dnssec-policy from the view or options
       blocks were not marked as inline-signed and therefore never scheduled
       to be re-signed. This has been fixed.

     - The old max-zone-ttl zone option was meant to be superseded by the
       max-zone-ttl option in dnssec-policy; however, the latter option was
       not fully effective. This has been corrected: zones no longer load if
       they contain TTLs greater than the limit configured in dnssec-policy.
       For zones with both the old max-zone-ttl option and dnssec-policy
       configured, the old option is ignored, and a warning is generated.

     - rndc dumpdb -expired was fixed to include expired RRsets, even if
       stale-cache-enable is set to no and the cache-cleaning time window has
       passed. (jsc#SLE-24600)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 15.4:

      zypper in -t patch openSUSE-SLE-15.4-2022-3767=1

   - SUSE Linux Enterprise Module for Server Applications 15-SP4:

      zypper in -t patch SUSE-SLE-Module-Server-Applications-15-SP4-2022-3767=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP4:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2022-3767=1



Package List:

   - openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64):

      bind-9.16.33-150400.5.11.1
      bind-debuginfo-9.16.33-150400.5.11.1
      bind-debugsource-9.16.33-150400.5.11.1
      bind-utils-9.16.33-150400.5.11.1
      bind-utils-debuginfo-9.16.33-150400.5.11.1

   - openSUSE Leap 15.4 (noarch):

      bind-doc-9.16.33-150400.5.11.1
      python3-bind-9.16.33-150400.5.11.1

   - SUSE Linux Enterprise Module for Server Applications 15-SP4 (aarch64 ppc64le s390x x86_64):

      bind-9.16.33-150400.5.11.1
      bind-debuginfo-9.16.33-150400.5.11.1
      bind-debugsource-9.16.33-150400.5.11.1

   - SUSE Linux Enterprise Module for Server Applications 15-SP4 (noarch):

      bind-doc-9.16.33-150400.5.11.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP4 (aarch64 ppc64le s390x x86_64):

      bind-debuginfo-9.16.33-150400.5.11.1
      bind-debugsource-9.16.33-150400.5.11.1
      bind-utils-9.16.33-150400.5.11.1
      bind-utils-debuginfo-9.16.33-150400.5.11.1

   - SUSE Linux Enterprise Module for Basesystem 15-SP4 (noarch):

      python3-bind-9.16.33-150400.5.11.1


References:

   https://www.suse.com/security/cve/CVE-2022-2795.html
   https://www.suse.com/security/cve/CVE-2022-3080.html
   https://www.suse.com/security/cve/CVE-2022-38177.html
   https://www.suse.com/security/cve/CVE-2022-38178.html
   https://bugzilla.suse.com/1201689
   https://bugzilla.suse.com/1203250
   https://bugzilla.suse.com/1203614
   https://bugzilla.suse.com/1203618
   https://bugzilla.suse.com/1203619
   https://bugzilla.suse.com/1203620



More information about the sle-updates mailing list