@@ -1,4 +1,4 @@
-From 7682cbc2fa624fbeeb088736e154090d92c8b524 Mon Sep 17 00:00:00 2001
+From 95141cf9494292fc5645165ef3d5e9e2ed2208c6 Mon Sep 17 00:00:00 2001
From: Chen Qi <Qi.Chen@windriver.com>
Date: Mon, 15 Oct 2018 16:55:09 +0800
Subject: [PATCH] avoid start failure with bind user
@@ -1,4 +1,4 @@
-From a633e336c248ceab41d3182848b65c95e90ef88c Mon Sep 17 00:00:00 2001
+From 06e9624eb7e474a08ed7e1a456bfe9759ba211da Mon Sep 17 00:00:00 2001
From: Khem Raj <khem.raj@oss.qualcomm.com>
Date: Fri, 10 Apr 2026 23:33:49 +0000
Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros
@@ -1,4 +1,4 @@
-From 4b870f60338fe45e036b8a76d47f053338920048 Mon Sep 17 00:00:00 2001
+From f28920a59b658fcda24efde1c45322f785a0b0fe Mon Sep 17 00:00:00 2001
From: Hongxu Jia <hongxu.jia@windriver.com>
Date: Mon, 27 Aug 2018 21:24:20 +0800
Subject: [PATCH] `named/lwresd -V' and start log hide build options
@@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster <akuster@mvista.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index 56bca5b..4fd62ed 100644
+index 0bc3965..e1c2b12 100644
--- a/configure.ac
+++ b/configure.ac
@@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par
@@ -1,4 +1,4 @@
-From f3736e5535236cf978fd368b6905098ff6e4fd84 Mon Sep 17 00:00:00 2001
+From f003f396067e6cc1e2ec609b296bb642b8ddf47b Mon Sep 17 00:00:00 2001
From: Paul Gortmaker <paul.gortmaker@windriver.com>
Date: Tue, 9 Jun 2015 11:22:00 -0400
Subject: [PATCH] bind: ensure searching for json headers searches sysroot
@@ -32,7 +32,7 @@ Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/configure.ac b/configure.ac
-index c06a0d7..56bca5b 100644
+index 26c442a..0bc3965 100644
--- a/configure.ac
+++ b/configure.ac
@@ -872,7 +872,7 @@ AS_CASE([$with_lmdb],
@@ -1,4 +1,4 @@
-From 450187e8feac041de02afd4c0c9039cc41e04cb9 Mon Sep 17 00:00:00 2001
+From 5fc3dfd3f994b5fd97e97837eee2ad808cd8af93 Mon Sep 17 00:00:00 2001
From: Qing He <qing.he@intel.com>
Date: Tue, 30 Nov 2010 13:35:42 +0800
Subject: [PATCH] bind: add new recipe
@@ -1,4 +1,4 @@
-From 582334d31432969be7e10906de7540f1dc64b17e Mon Sep 17 00:00:00 2001
+From 42c109317070d19fda70635b7043cbc6f9ec36ef Mon Sep 17 00:00:00 2001
From: Chen Qi <Qi.Chen@windriver.com>
Date: Thu, 27 Mar 2014 02:34:41 +0000
Subject: [PATCH] init.d: add support for read-only rootfs
@@ -1,4 +1,4 @@
-From 50601a7ee8fd19ddbe9a592c57ae6197782d4c2f Mon Sep 17 00:00:00 2001
+From 2e1314f2e71be15704ba18756250185b36a5c0da Mon Sep 17 00:00:00 2001
From: Roy Li <rongqing.li@windriver.com>
Date: Thu, 15 Nov 2012 02:27:54 +0000
Subject: [PATCH] bind: make "/etc/init.d/bind stop" work
similarity index 97%
rename from meta/recipes-connectivity/bind/bind_9.20.27.bb
rename to meta/recipes-connectivity/bind/bind_9.20.29.bb
@@ -21,7 +21,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \
file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \
"
-SRC_URI[sha256sum] = "145ab7a50b33a06d9d488b5e668c887e754f42acf8954e2b5dc7e238b080e4a0"
+SRC_URI[sha256sum] = "587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1"
UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/"
# follow the ESV versions divisible by 2
Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *bind* to *9.20.29* has Succeeded. Next steps: - apply the patch: git am 0001-bind-upgrade-9.20.27-9.20.29.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 64cefd8c4db9e91b9782d04d85d1e6c1d578ea9e Mon Sep 17 00:00:00 2001 From: Upgrade Helper <auh@yoctoproject.org> Date: Thu, 17 Sep 2026 05:32:24 +0000 Subject: [PATCH] bind: upgrade 9.20.27 -> 9.20.29 Source: doc/changelog/changelog-9.20.28.rst, doc/changelog/changelog-9.20.29.rst BIND 9.20.28 ------------ .. note:: The BIND 9.20.28 release was withdrawn after the discovery of a regression in it during pre-release testing. BIND 9.20.29 ------------ Security Fixes ~~~~~~~~~~~~~~ - [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC responses. ``a0a61dba9e`` A malicious authoritative server could serve a securely delegated zone whose DS and DNSKEY records carry many distinct key tags but no valid match, forcing a validating resolver into excessive key-tag matching and high CPU use for every query. BIND now bounds this work with the per-query validation limit (max-validations-per-fetch). :gl:`#5349` - [CVE-2026-19033] Require a TSIG on every message of incoming zone transfers. ``9404cd2b8c`` BIND 9 used to accept TSIG-signed zone transfers in which some messages were unsigned, and processed those messages before the next signature could vouch for them. It now requires a TSIG on every message of an incoming AXFR or IXFR; all modern nameserver already sign every message, so no change is expected in practice. :gl:`#6062` - [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3. ``3bed9c8e9e`` A validating resolver could be tricked into treating a secure delegation as unsigned and accepting forged answers for names beneath it, if an attacker could inject responses to its queries. Such forged proofs are now rejected. :gl:`#6234` - [CVE-2026-19941] Prevent forged DNSSEC-validated NXDOMAIN responses. ``a36bf58daf`` A validating resolver could accept a signed NSEC record from an unrelated zone as proof that a wildcard did not exist. An on-path attacker or malicious forwarder controlling a signed zone could therefore forge an authenticated NXDOMAIN response for a name that should resolve through a wildcard. BIND now requires the wildcard-denial and name-nonexistence proofs to be signed by the same zone. :gl:`#6253` - [CVE-2026-19666] DNS64 with break-dnssec could cause an assertion failure. ``4cec4965c4`` When a "dns64" statement is configured with "break-dnssec yes" and its "exclude" list matches some but not all of the addresses in an AAAA RRset, named removes the excluded addresses from the answer instead of synthesizing new ones. If the answer being filtered had been cached together with a proof that the queried name does not exist -- which is what a wildcard match produces -- named terminated with an assertion failure. Only recursive resolvers are affected, and only when "break-dnssec yes" is in use; the answer has to come from the cache, so a server that is only authoritative cannot reach this. :gl:`#6301` - [CVE-2026-19667] Reject negative cache records that do not fit in a dns_rdata_t. ``dbf08c8581`` A single crafted response from a server could make a resolver cache a malformed negative entry and th [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +- .../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch | 2 +- ...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++-- ...bind-ensure-searching-for-json-headers-searches-sysr.patch | 4 ++-- meta/recipes-connectivity/bind/bind/conf.patch | 2 +- .../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +- .../bind/bind/make-etc-initd-bind-stop-work.patch | 2 +- .../bind/{bind_9.20.27.bb => bind_9.20.29.bb} | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) rename meta/recipes-connectivity/bind/{bind_9.20.27.bb => bind_9.20.29.bb} (97%)