This update for bind fixes the following issues:
- CVE-2024-1737: It is possible to craft excessively large numbers of
resource record types for a given owner name, which has the effect of
slowing down database processing. This has been addressed by
adding a configurable limit to the number of records that can
be stored per name and type in a cache or zone database. The
default is 100, which can be tuned with the new
max-types-per-name option. (bsc#1228256)
- CVE-2024-1975: Validating DNS messages signed using the SIG(0)
protocol (RFC 2931) could cause excessive CPU load, leading to a
denial-of-service condition. Support for
This update for bind fixes the following issues:
- CVE-2023-4408: Fixed denial of service during DNS message parsing with different names (bsc#1219851)
- CVE-2023-50387: Fixed denial of service during DNS messages validation with DNSSEC signatures (bsc#1219823)
- CVE-2023-50868: Fixed denial of service during NSEC3 closest encloser proof preparation (bsc#1219826)
- CVE-2023-5517: Fixed denial of service caused by specific queries with nxdomain-redirect enabled (bsc#1219852)
- CVE-2023-6516: Fixed denial of service caused by specific queries that continuously triggered cache database maintenance (bsc#1219854)
This update for bind fixes the following issues:
- CVE-2023-3341: Fixed stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (bsc#1215472).
This update for bind fixes the following issues:
- CVE-2023-2828: Fixed denial-of-service against recursive resolvers related to cache-cleaning algorithm (bsc#1212544).
This update fixes the following issues:
bind:
- Provide bind dependencies and solve installation issues on SUSE Linux Enterprise Micro
- There are no source changes
dracut-saltboot:
- Update to version 0.1.1681904360.84ef141
* Load network configuration even when missing protocol version (bsc#1210640)
grafana:
- Version update from 8.5.22 to 9.5.1 (jsc#PED-3694):
* Security fixes:
- CVE-2023-1410: grafana: Stored XSS in Graphite FunctionDescription tooltip (bsc#1209645)
- CVE-2023-1387: grafana: JWT URL-login flow leaks token to data sources through request parameter in proxy requests
(bnc#1210907)
- C
This update for bind fixes the following issues:
- CVE-2022-2795: Fixed potential performance degredation due to missing database lookup limits when processing large delegations (bsc#1203614).
- CVE-2022-38177: Fixed a memory leak that could be externally triggered in the DNSSEC verification code for the ECDSA algorithm (bsc#1203619).
- CVE-2022-38178: Fixed memory leaks that could be externally triggered in the DNSSEC verification code for the EdDSA algorithm (bsc#1203620).