Your message dated Fri, 27 Feb 2015 18:52:11 +0100
with message-id <[email protected]>
and subject line Re: Bug#778734: unblock: bind9/9.9.5.dfsg-9
has caused the Debian Bug report #778734,
regarding unblock: bind9/9.9.5.dfsg-9
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
778734: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=778734
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
package: release.debian.org
user: [email protected]
usertags: unblock
severity: normal
x-debbugs-cc: [email protected]
Please consider unblocking bind9. It fixes a new security issue.
unblock bind9/9.9.5.dfsg-9
unblock-udeb bind9/9.9.5.dfsg-9
diff -u bind9-9.9.5.dfsg/debian/changelog bind9-9.9.5.dfsg/debian/changelog
--- bind9-9.9.5.dfsg/debian/changelog
+++ bind9-9.9.5.dfsg/debian/changelog
@@ -1,3 +1,10 @@
+bind9 (1:9.9.5.dfsg-9) unstable; urgency=high
+
+ * Fix CVE-2015-1349: named crash due to managed key rollover, primarily only
+ affecting setups using DNSSEC (closes: #778733).
+
+ -- Michael Gilbert <[email protected]> Thu, 19 Feb 2015 03:42:21 +0000
+
bind9 (1:9.9.5.dfsg-8) unstable; urgency=medium
* Launch rndc command in the background in networking scripts to avoid a
only in patch2:
unchanged:
--- bind9-9.9.5.dfsg.orig/lib/dns/zone.c
+++ bind9-9.9.5.dfsg/lib/dns/zone.c
@@ -8496,6 +8496,12 @@
namebuf, tag);
trustkey = ISC_TRUE;
}
+ } else {
+ /*
+ * No previously known key, and the key is not
+ * secure, so skip it.
+ */
+ continue;
}
/* Delete old version */
@@ -8544,7 +8550,7 @@
trust_key(zone, keyname, &dnskey, mctx);
}
- if (!deletekey)
+ if (secure && !deletekey)
set_refreshkeytimer(zone, &keydata, now);
}
--- End Message ---
--- Begin Message ---
Hi,
On Fri, Feb 27, 2015 at 01:11:50AM +0100, Cyril Brulebois wrote:
> Steven Chamberlain <[email protected]> (2015-02-26):
> > Cyril Brulebois wrote:
> > > No objection on my side, but let's give BSD folks a heads-up since
> > > isc-dhcp-client-udeb depends on bind9's udebs.
> >
> > Thanks, the changes seem to only relate to authoritative DNS zones
> > though. No foreseeable impact on ISC DHCP or d-i.
>
> ACK, let's do that then.
Added unblock-udeb.
Cheers,
Ivo
--- End Message ---
