SUSE-SU-2026:3452-1

SUSE-SU-2026:3452-1 · Security update for bind

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

This update for bind fixes the following issues: - CVE-2026-10723: accepting incorrect child-zone NSEC3 records as valid can allow an attacker to forge authenticated NXDOMAIN responses for sibling zones (bsc#1271982). - CVE-2026-10822: storing a DNS key record with an invalid PRIVATEDNS algorithm identifier length can trigger a consistency check failure (bsc#1271983). - CVE-2026-11331: handling NAMETOOLONG error conditions incorrectly during RPZ wildcard CNAME processing can allow bypassing RPZ rules or triggering process exits (bsc#1271984). - CVE-2026-11622: DNSSEC validating resolver under a random subdomain attack can suffer from runaway memory usage exceeding max-cache-size and affecting response rate (bsc#1271986). - CVE-2026-11721: RRSIG with fewer labels than its containing zone when synth-from-dnssec is enabled can lead to wildcard generation (bsc#1271987). - CVE-2026-12617: delayed or specific CNAME/DNAME query responses combined with positive A record responses can trigger an assertion failure (bsc#1271988). - CVE-2026-13204: validating a domain covered by both NSEC and NSEC3 with an RRSIG for only one type can trigger an assertion failure (bsc#1271989). - CVE-2026-13321: NSEC records with a `Next Domain Name` pointing outside the signer's zone can allow cross-zone cache poisoning and authenticated denial-of-service responses (bsc#1271990). - Update to release 9.18.50: * Remove ineffective TCP fallback after repeated UDP timeouts. * Fall back to TCP on receipt of a UDP response with a mismatched query ID. * Fix DNS64 owner case after DNAME restart. * Clear REDIRECT flag when it isn't needed.

Corrección disponible

Publicación

2026-08-03T11:34:55Z

Actualización

2026-08-04T11:45:06.336072676Z

Pila tecnológica: system

Comprueba tu servidor →