From patchwork Thu Sep 17 07:10:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 98515 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFC43C982D4 for ; Thu, 17 Sep 2026 07:10:08 +0000 (UTC) Received: from a27-193.smtp-out.us-west-2.amazonses.com (a27-193.smtp-out.us-west-2.amazonses.com [54.240.27.193]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.33964.1789629007950627574 for ; Thu, 17 Sep 2026 00:10:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=fE5vXw8f; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=Q7tTrqtz; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.193, mailfrom: 010101a0ae33845a-81b05745-7d91-4949-b0ca-58cd1fa428b1-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1789629007; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date; bh=kU5WwJA/8Hx7uFkn2Fhi4tzBuy2nqvTr16lbOG4eF2M=; b=fE5vXw8f/8aHiC841QzuUOpwcX6Ke7g7Ik0EdAFV6td3h/6wuaJBPvUNbMyDfsnq yIDQfOWU2/EAkkhFEm65jAEaG+dF/7P7RO8gnMauxg/Jm3iToVW3f9VcK5SBe7Y0V1F a93ffDQV0ssLyMuLByBmfwr1MaArzvNhdEzQTJiA= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1789629007; h=Content-Type:MIME-Version:From:To:Subject:Message-Id:Date:Feedback-ID; bh=kU5WwJA/8Hx7uFkn2Fhi4tzBuy2nqvTr16lbOG4eF2M=; b=Q7tTrqtzoWvTcFKC2IfFDy3JPK+K7xQADDAvYszYwfOiGsPdctQEjVjvNEGrDtOe tRw12zsy26kOdw1Ext1K5di9P5qRRd/xxR0g4n4f42BLpt/8p8iU6PT1yrxLsbSmkbh FVc0fJpVHgGojWHspYGShzHg7tYOaQ2YWFlMJ3tU= MIME-Version: 1.0 From: auh@yoctoproject.org To: openembedded-core@lists.openembedded.org Subject: [AUH] bind: upgrading to 9.20.29 SUCCEEDED Message-ID: <010101a0ae33845a-81b05745-7d91-4949-b0ca-58cd1fa428b1-000000@us-west-2.amazonses.com> Date: Thu, 17 Sep 2026 07:10:06 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.17-54.240.27.193 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Thu, 17 Sep 2026 07:10:08 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246030 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *bind* to *9.20.29* has Succeeded. Next steps: - apply the patch: git am 0001-bind-upgrade-9.20.27-9.20.29.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 64cefd8c4db9e91b9782d04d85d1e6c1d578ea9e Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Thu, 17 Sep 2026 05:32:24 +0000 Subject: [PATCH] bind: upgrade 9.20.27 -> 9.20.29 Source: doc/changelog/changelog-9.20.28.rst, doc/changelog/changelog-9.20.29.rst BIND 9.20.28 ------------ .. note:: The BIND 9.20.28 release was withdrawn after the discovery of a regression in it during pre-release testing. BIND 9.20.29 ------------ Security Fixes ~~~~~~~~~~~~~~ - [CVE-2026-19668] Prevent excessive CPU use validating crafted DNSSEC responses. ``a0a61dba9e`` A malicious authoritative server could serve a securely delegated zone whose DS and DNSKEY records carry many distinct key tags but no valid match, forcing a validating resolver into excessive key-tag matching and high CPU use for every query. BIND now bounds this work with the per-query validation limit (max-validations-per-fetch). :gl:`#5349` - [CVE-2026-19033] Require a TSIG on every message of incoming zone transfers. ``9404cd2b8c`` BIND 9 used to accept TSIG-signed zone transfers in which some messages were unsigned, and processed those messages before the next signature could vouch for them. It now requires a TSIG on every message of an incoming AXFR or IXFR; all modern nameserver already sign every message, so no change is expected in practice. :gl:`#6062` - [CVE-2026-77119] Prevent a DNSSEC downgrade of secure delegations via unrelated NSEC3. ``3bed9c8e9e`` A validating resolver could be tricked into treating a secure delegation as unsigned and accepting forged answers for names beneath it, if an attacker could inject responses to its queries. Such forged proofs are now rejected. :gl:`#6234` - [CVE-2026-19941] Prevent forged DNSSEC-validated NXDOMAIN responses. ``a36bf58daf`` A validating resolver could accept a signed NSEC record from an unrelated zone as proof that a wildcard did not exist. An on-path attacker or malicious forwarder controlling a signed zone could therefore forge an authenticated NXDOMAIN response for a name that should resolve through a wildcard. BIND now requires the wildcard-denial and name-nonexistence proofs to be signed by the same zone. :gl:`#6253` - [CVE-2026-19666] DNS64 with break-dnssec could cause an assertion failure. ``4cec4965c4`` When a "dns64" statement is configured with "break-dnssec yes" and its "exclude" list matches some but not all of the addresses in an AAAA RRset, named removes the excluded addresses from the answer instead of synthesizing new ones. If the answer being filtered had been cached together with a proof that the queried name does not exist -- which is what a wildcard match produces -- named terminated with an assertion failure. Only recursive resolvers are affected, and only when "break-dnssec yes" is in use; the answer has to come from the cache, so a server that is only authoritative cannot reach this. :gl:`#6301` - [CVE-2026-19667] Reject negative cache records that do not fit in a dns_rdata_t. ``dbf08c8581`` A single crafted response from a server could make a resolver cache a malformed negative entry and th [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- .../bind/bind/0001-avoid-start-failure-with-bind-user.patch | 2 +- .../0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch | 2 +- ...0001-named-lwresd-V-and-start-log-hide-build-options.patch | 4 ++-- ...bind-ensure-searching-for-json-headers-searches-sysr.patch | 4 ++-- meta/recipes-connectivity/bind/bind/conf.patch | 2 +- .../bind/bind/init.d-add-support-for-read-only-rootfs.patch | 2 +- .../bind/bind/make-etc-initd-bind-stop-work.patch | 2 +- .../bind/{bind_9.20.27.bb => bind_9.20.29.bb} | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) rename meta/recipes-connectivity/bind/{bind_9.20.27.bb => bind_9.20.29.bb} (97%) diff --git a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch index 30da1e9fd3..15796a15fb 100644 --- a/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch +++ b/meta/recipes-connectivity/bind/bind/0001-avoid-start-failure-with-bind-user.patch @@ -1,4 +1,4 @@ -From 7682cbc2fa624fbeeb088736e154090d92c8b524 Mon Sep 17 00:00:00 2001 +From 95141cf9494292fc5645165ef3d5e9e2ed2208c6 Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Mon, 15 Oct 2018 16:55:09 +0800 Subject: [PATCH] avoid start failure with bind user diff --git a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch index f1d8a8e569..99e781799d 100644 --- a/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch +++ b/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch @@ -1,4 +1,4 @@ -From a633e336c248ceab41d3182848b65c95e90ef88c Mon Sep 17 00:00:00 2001 +From 06e9624eb7e474a08ed7e1a456bfe9759ba211da Mon Sep 17 00:00:00 2001 From: Khem Raj Date: Fri, 10 Apr 2026 23:33:49 +0000 Subject: [PATCH] m4: Backport ax_prog_cc_for_build.m4 macros diff --git a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch index da4057064e..80a4f2abde 100644 --- a/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch +++ b/meta/recipes-connectivity/bind/bind/0001-named-lwresd-V-and-start-log-hide-build-options.patch @@ -1,4 +1,4 @@ -From 4b870f60338fe45e036b8a76d47f053338920048 Mon Sep 17 00:00:00 2001 +From f28920a59b658fcda24efde1c45322f785a0b0fe Mon Sep 17 00:00:00 2001 From: Hongxu Jia Date: Mon, 27 Aug 2018 21:24:20 +0800 Subject: [PATCH] `named/lwresd -V' and start log hide build options @@ -20,7 +20,7 @@ Signed-off-by: Armin Kuster 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index 56bca5b..4fd62ed 100644 +index 0bc3965..e1c2b12 100644 --- a/configure.ac +++ b/configure.ac @@ -35,7 +35,7 @@ AC_DEFINE([PACKAGE_VERSION_EXTRA], ["][bind_VERSION_EXTRA]["], [BIND 9 Extra par diff --git a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch index 9adc101247..323985a402 100644 --- a/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch +++ b/meta/recipes-connectivity/bind/bind/bind-ensure-searching-for-json-headers-searches-sysr.patch @@ -1,4 +1,4 @@ -From f3736e5535236cf978fd368b6905098ff6e4fd84 Mon Sep 17 00:00:00 2001 +From f003f396067e6cc1e2ec609b296bb642b8ddf47b Mon Sep 17 00:00:00 2001 From: Paul Gortmaker Date: Tue, 9 Jun 2015 11:22:00 -0400 Subject: [PATCH] bind: ensure searching for json headers searches sysroot @@ -32,7 +32,7 @@ Signed-off-by: Paul Gortmaker 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac -index c06a0d7..56bca5b 100644 +index 26c442a..0bc3965 100644 --- a/configure.ac +++ b/configure.ac @@ -872,7 +872,7 @@ AS_CASE([$with_lmdb], diff --git a/meta/recipes-connectivity/bind/bind/conf.patch b/meta/recipes-connectivity/bind/bind/conf.patch index 803456c0b3..28ee4ae74d 100644 --- a/meta/recipes-connectivity/bind/bind/conf.patch +++ b/meta/recipes-connectivity/bind/bind/conf.patch @@ -1,4 +1,4 @@ -From 450187e8feac041de02afd4c0c9039cc41e04cb9 Mon Sep 17 00:00:00 2001 +From 5fc3dfd3f994b5fd97e97837eee2ad808cd8af93 Mon Sep 17 00:00:00 2001 From: Qing He Date: Tue, 30 Nov 2010 13:35:42 +0800 Subject: [PATCH] bind: add new recipe diff --git a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch index a2c1fbb8f7..b373251c47 100644 --- a/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch +++ b/meta/recipes-connectivity/bind/bind/init.d-add-support-for-read-only-rootfs.patch @@ -1,4 +1,4 @@ -From 582334d31432969be7e10906de7540f1dc64b17e Mon Sep 17 00:00:00 2001 +From 42c109317070d19fda70635b7043cbc6f9ec36ef Mon Sep 17 00:00:00 2001 From: Chen Qi Date: Thu, 27 Mar 2014 02:34:41 +0000 Subject: [PATCH] init.d: add support for read-only rootfs diff --git a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch index dc1f8f5a9a..74cf947787 100644 --- a/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch +++ b/meta/recipes-connectivity/bind/bind/make-etc-initd-bind-stop-work.patch @@ -1,4 +1,4 @@ -From 50601a7ee8fd19ddbe9a592c57ae6197782d4c2f Mon Sep 17 00:00:00 2001 +From 2e1314f2e71be15704ba18756250185b36a5c0da Mon Sep 17 00:00:00 2001 From: Roy Li Date: Thu, 15 Nov 2012 02:27:54 +0000 Subject: [PATCH] bind: make "/etc/init.d/bind stop" work diff --git a/meta/recipes-connectivity/bind/bind_9.20.27.bb b/meta/recipes-connectivity/bind/bind_9.20.29.bb similarity index 97% rename from meta/recipes-connectivity/bind/bind_9.20.27.bb rename to meta/recipes-connectivity/bind/bind_9.20.29.bb index e915161d8c..c280d5b98d 100644 --- a/meta/recipes-connectivity/bind/bind_9.20.27.bb +++ b/meta/recipes-connectivity/bind/bind_9.20.29.bb @@ -21,7 +21,7 @@ SRC_URI = "https://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.xz \ file://0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch \ " -SRC_URI[sha256sum] = "145ab7a50b33a06d9d488b5e668c887e754f42acf8954e2b5dc7e238b080e4a0" +SRC_URI[sha256sum] = "587029508b3b1b43229fae416c97e5543aba45809cefaca98a5004a02a5736c1" UPSTREAM_CHECK_URI = "https://ftp.isc.org/isc/bind9/" # follow the ESV versions divisible by 2