Summary
[32:9.16.23-34.0.1.1]
- Fix warning when changing device file permissions [Orabug: 36518580]
[32:9.16.23-34.1]
- Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
- Replace downstream fixes with upstream changes
- Address various spoofing attacks (CVE-2025-40778)
[32:9.16.23-34]
- Fix failures in idna system test (RHEL-66172)
[32:9.16.23-33]
- logrotate: skip if empty and remove old variants (RHEL-113942)
[32:9.16.23-32]
- Decode IDN names on input in all situations in utilities (RHEL-66172)
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | bind | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-chroot | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-devel | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-dnssec-doc | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-dnssec-utils | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-doc | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-libs | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-license | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | bind-utils | 32:9.16.23-34.0.1.el9_7.1 |
| Oracle Linux · 9 | python3-bind | 32:9.16.23-34.0.1.el9_7.1 |
Vulnerabilities 2
-
High 8.6CVE-2025-40778 Public exploit
Cache poisoning attacks with unsolicited RRs
Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 …
-
High 8.6
Cache poisoning due to weak PRNG
In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.…