Oracle Linux Security Advisory ELSA-2024-5231

http://linux.oracle.com/errata/ELSA-2024-5231.html

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

x86_64:
bind-9.16.23-18.0.1.el9_4.6.x86_64.rpm
bind-chroot-9.16.23-18.0.1.el9_4.6.x86_64.rpm
bind-dnssec-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-dnssec-utils-9.16.23-18.0.1.el9_4.6.x86_64.rpm
bind-dyndb-ldap-11.9-10.el9_4.x86_64.rpm
bind-libs-9.16.23-18.0.1.el9_4.6.x86_64.rpm
bind-license-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-utils-9.16.23-18.0.1.el9_4.6.x86_64.rpm
python3-bind-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-devel-9.16.23-18.0.1.el9_4.6.i686.rpm
bind-devel-9.16.23-18.0.1.el9_4.6.x86_64.rpm
bind-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-libs-9.16.23-18.0.1.el9_4.6.i686.rpm

aarch64:
bind-9.16.23-18.0.1.el9_4.6.aarch64.rpm
bind-chroot-9.16.23-18.0.1.el9_4.6.aarch64.rpm
bind-dnssec-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-dnssec-utils-9.16.23-18.0.1.el9_4.6.aarch64.rpm
bind-dyndb-ldap-11.9-10.el9_4.aarch64.rpm
bind-libs-9.16.23-18.0.1.el9_4.6.aarch64.rpm
bind-license-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-utils-9.16.23-18.0.1.el9_4.6.aarch64.rpm
python3-bind-9.16.23-18.0.1.el9_4.6.noarch.rpm
bind-devel-9.16.23-18.0.1.el9_4.6.aarch64.rpm
bind-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm


SRPMS:
http://oss.oracle.com/ol9/SRPMS-updates//bind-9.16.23-18.0.1.el9_4.6.src.rpm
http://oss.oracle.com/ol9/SRPMS-updates//bind-dyndb-ldap-11.9-10.el9_4.src.rpm

Related CVEs:

CVE-2024-1737
CVE-2024-1975
CVE-2024-4076




Description of changes:

bind
[9.16.23-18.0.1.6]
- Fix warning when changing device file permissions [Orabug: 36518580]

[32:9.16.23-18.6]
- Minor fix of reclimit test backport (CVE-2024-1737)

[32:9.16.23-18.5]
- Backport addition of max-records-per-type and max-records-per-type options

[32:9.16.23-18.2]
- Resolve CVE-2024-1975
- Resolve CVE-2024-1737
- Resolve CVE-2024-4076
- Add ability to change runtime limits for max types and records per name

[32:9.16.23-18.1]
- Rebuild with correct z-stream tag again

[32:9.16.23-18]
- Prevent crashing at masterformat system test (CVE-2023-6516)

[32:9.16.23-17]
- Import tests for large DNS messages fix
- Add downstream change complementing CVE-2023-50387

[32:9.16.23-16]
- Prevent increased CPU load on large DNS messages (CVE-2023-4408)
- Prevent assertion failure when nxdomain-redirect is used with
 RFC 1918 reverse zones (CVE-2023-5517)
- Prevent assertion failure if DNS64 and serve-stale is used (CVE-2023-5679)
- Specific recursive query patterns may lead to an out-of-memory
  condition (CVE-2023-6516)
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
  CVE-2023-50868)

[32:9.16.23-15]
- Update addresses of b.root-servers.net (RHEL-18188)

[32:9.16.23-14]
- Limit the amount of recursion possible in control channel (CVE-2023-3341)

[32:9.16.23-13]
- Prevent possible endless loop when refreshing stale data (CVE-2023-2911)

[32:9.16.23-12]
- Strengten cache cleaning to prevent overflowing configured limit
  (CVE-2023-2828)

[32:9.16.23-11]
- Correct backport issue in statistics rendering fix (#2126912)

[32:9.16.23-10]
- Handle subtle difference between upstream and rhel (CVE-2022-3094)

[32:9.16.23-9]
- Prevent flooding with UPDATE requests (CVE-2022-3094)
- Handle RRSIG queries when server-stale is active (CVE-2022-3736)
- Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924)

[32:9.16.23-8]
- Correct regression preventing bind-dyndb-ldap build (#2162795)

[32:9.16.23-7]
- Prevent freeing zone during statistics rendering (#2101712)

[32:9.16.23-6]
- Bound the amount of work performed for delegations (CVE-2022-2795)
- Add /usr/lib64/named to bind-chroot (#2129466)

[32:9.16.23-5]
- Fix possible serve-stale related crash (CVE-2022-3080)
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)

bind-dyndb-ldap
[11.9-10]
- Rebuilt for BIND CVE-2024-1737 fixes (CVE-2024-1737)


_______________________________________________
El-errata mailing list
El-errata@oss.oracle.com
https://oss.oracle.com/mailman/listinfo/el-errata

Oracle9: ELSA-2024-5231: bind and bind-dyndb-ldap Important Security Advisory Updates

The following updated rpms for Oracle Linux 9 have been uploaded to the Unbreakable Linux Network:

Summary

bind [9.16.23-18.0.1.6] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.16.23-18.6] - Minor fix of reclimit test backport (CVE-2024-1737) [32:9.16.23-18.5] - Backport addition of max-records-per-type and max-records-per-type options [32:9.16.23-18.2] - Resolve CVE-2024-1975 - Resolve CVE-2024-1737 - Resolve CVE-2024-4076 - Add ability to change runtime limits for max types and records per name [32:9.16.23-18.1] - Rebuild with correct z-stream tag again [32:9.16.23-18] - Prevent crashing at masterformat system test (CVE-2023-6516) [32:9.16.23-17] - Import tests for large DNS messages fix - Add downstream change complementing CVE-2023-50387 [32:9.16.23-16] - Prevent increased CPU load on large DNS messages (CVE-2023-4408) - Prevent assertion failure when nxdomain-redirect is used with RFC 1918 reverse zones (CVE-2023-5517) - Prevent assertion failure if DNS64 and serve-stale is used (CVE-2023-5679) - Specific recursive query patterns may lead to an out-of-memory condition (CVE-2023-6516) - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868) [32:9.16.23-15] - Update addresses of b.root-servers.net (RHEL-18188) [32:9.16.23-14] - Limit the amount of recursion possible in control channel (CVE-2023-3341) [32:9.16.23-13] - Prevent possible endless loop when refreshing stale data (CVE-2023-2911) [32:9.16.23-12] - Strengten cache cleaning to prevent overflowing configured limit (CVE-2023-2828) [32:9.16.23-11] - Correct backport issue in statistics rendering fix (#2126912) [32:9.16.23-10] - Handle subtle difference between upstream and rhel (CVE-2022-3094) [32:9.16.23-9] - Prevent flooding with UPDATE requests (CVE-2022-3094) - Handle RRSIG queries when server-stale is active (CVE-2022-3736) - Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924) [32:9.16.23-8] - Correct regression preventing bind-dyndb-ldap build (#2162795) [32:9.16.23-7] - Prevent freeing zone during statistics rendering (#2101712) [32:9.16.23-6] - Bound the amount of work performed for delegations (CVE-2022-2795) - Add /usr/lib64/named to bind-chroot (#2129466) [32:9.16.23-5] - Fix possible serve-stale related crash (CVE-2022-3080) - Fix memory leak in ECDSA verify processing (CVE-2022-38177) - Fix memory leak in EdDSA verify processing (CVE-2022-38178) bind-dyndb-ldap [11.9-10] - Rebuilt for BIND CVE-2024-1737 fixes (CVE-2024-1737)

SRPMs

http://oss.oracle.com/ol9/SRPMS-updates//bind-9.16.23-18.0.1.el9_4.6.src.rpm http://oss.oracle.com/ol9/SRPMS-updates//bind-dyndb-ldap-11.9-10.el9_4.src.rpm

x86_64

bind-9.16.23-18.0.1.el9_4.6.x86_64.rpm bind-chroot-9.16.23-18.0.1.el9_4.6.x86_64.rpm bind-dnssec-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-dnssec-utils-9.16.23-18.0.1.el9_4.6.x86_64.rpm bind-dyndb-ldap-11.9-10.el9_4.x86_64.rpm bind-libs-9.16.23-18.0.1.el9_4.6.x86_64.rpm bind-license-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-utils-9.16.23-18.0.1.el9_4.6.x86_64.rpm python3-bind-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-devel-9.16.23-18.0.1.el9_4.6.i686.rpm bind-devel-9.16.23-18.0.1.el9_4.6.x86_64.rpm bind-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-libs-9.16.23-18.0.1.el9_4.6.i686.rpm

aarch64

bind-9.16.23-18.0.1.el9_4.6.aarch64.rpm bind-chroot-9.16.23-18.0.1.el9_4.6.aarch64.rpm bind-dnssec-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-dnssec-utils-9.16.23-18.0.1.el9_4.6.aarch64.rpm bind-dyndb-ldap-11.9-10.el9_4.aarch64.rpm bind-libs-9.16.23-18.0.1.el9_4.6.aarch64.rpm bind-license-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-utils-9.16.23-18.0.1.el9_4.6.aarch64.rpm python3-bind-9.16.23-18.0.1.el9_4.6.noarch.rpm bind-devel-9.16.23-18.0.1.el9_4.6.aarch64.rpm bind-doc-9.16.23-18.0.1.el9_4.6.noarch.rpm

i386

Severity
Related CVEs: CVE-2024-1737 CVE-2024-1975 CVE-2024-4076

Related News

Fighting Back Against Hadooken Malware by Strengthening WebLogic Security
2 - 4 min read
Cybercriminals have been relentlessly attacking the digital landscape, aiming to exploit vulnerabilities in well-known systems. One such exploit is
CISA Sounds Alarm on Newly Exploited Vulnerabilities: Is Your System at Risk?
3 - 5 min read
CISA regularly publishes updates regarding vulnerabilities that present severe threats to global cybersecurity. Recently, CISA added three
Navigating the Linux Kernel
2 - 4 min read
The Linux operating system, widely acclaimed for its robustness and security , recently received widespread media attention due to a significant
Defending Against Remote Code Execution in Google Chrome: A Critical Update
2 - 3 min read
Google Chrome, a widely used web browser, serves millions of internet users by connecting them to the online world. Unfortunately, severe
Staying a Step Ahead of Adversaries: Mitigating Chromium
2 - 4 min read
Google Chrome, one of the world's most widely used web browsers, has recently been scrutinized due to the discovery of multiple Chromium
Unmasking Cicada3301: Examining the Threat of the New Rust-Based Ransomware
2 - 4 min read
Ransomware has long been a severe threat to organizations and admins alike. Recently, cybersecurity researchers discovered a new variant called
Buffer Overflow Exploits in Linux: Origins, Impact, and Countermeasures
3 - 6 min read
Buffer overflow vulnerabilities have long been one of the biggest headaches in computer security, especially on Linux operating systems that power
8 Expert-Recommended Security Practices to Fortify Your Linux Systems
4 - 8 min read
As a Linux admin or an infosec professional, you understand how the security landscape changes due to evolving threats, newly discovered

Get the Latest News & Insights

Sign up to get the latest security news affecting Linux and open source delivered straight to your inbox.

© 2024 Guardian Digital, Inc All Rights Reserved