bind9 (1:9.20.24-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2157486). Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
    - d/e/apparmor.d/usr.sbin.named: Allow read access to
      /proc/version_signature for named (LP #2119320)

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 18 Jun 2026 12:22:05 -0400

bind9 (1:9.20.24-1) unstable; urgency=medium

  * New upstream version 9.20.24

 -- Ondřej Surý <ondrej@debian.org>  Wed, 17 Jun 2026 14:43:58 +0200

bind9 (1:9.20.23-1ubuntu1) stonking; urgency=medium

  * Merge with Debian unstable (LP: #2154096). Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
    - d/e/apparmor.d/usr.sbin.named: Allow read access to
      /proc/version_signature for named (LP #2119320)
  * Drop Changes:
    - d/bind9.maintscript: rm_conffile for incompatible named.conf
      (LP #2150582)
    [Uploaded by mistake in 1:9.20.18-1ubuntu3]
    - d/p/CVE-2026-1519-1.patch
    - d/p/CVE-2026-1519-2.patch
    - d/p/CVE-2026-1519-3.patch
    - d/p/CVE-2026-1519-4.patch
    - d/p/CVE-2026-1519-5.patch
    - d/p/CVE-2026-3104-1.patch
    - d/p/CVE-2026-3104-2.patch
    - d/p/CVE-2026-3119-1.patch
    - d/p/CVE-2026-3119-2.patch
    - d/p/CVE-2026-3591-1.patch
    - d/p/CVE-2026-3591-2.patch
    [Fixed in 9.20.21]
    - d/p/CVE-2026-3039-pre1.patch
    - d/p/CVE-2026-3039-1.patch
    - d/p/CVE-2026-3039-3.patch
    - d/p/CVE-2026-3592-1.patch
    - d/p/CVE-2026-3592-2.patch
    - d/p/CVE-2026-3592-3.patch
    - d/p/CVE-2026-3592-4.patch
    - d/p/CVE-2026-3593-1.patch
    - d/p/CVE-2026-3593-2.patch
    - d/p/CVE-2026-5946-1.patch
    - d/p/CVE-2026-5946-2.patch
    - d/p/CVE-2026-5946-3.patch
    - d/p/CVE-2026-5946-4.patch
    - d/p/CVE-2026-5946-5.patch
    - d/p/CVE-2026-5946-6.patch
    - d/p/CVE-2026-5946-7.patch
    - d/p/CVE-2026-5946-8.patch
    - d/p/CVE-2026-5946-9.patch
    - d/p/CVE-2026-5947.patch
    - d/p/CVE-2026-5950-1.patch
    - d/p/CVE-2026-5950-2.patch
    - d/p/CVE-2026-5950-3.patch
    [Fixed in 9.20.23]

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 28 May 2026 14:49:56 -0400

bind9 (1:9.20.23-1) unstable; urgency=high

  * New upstream version 9.20.23
   + [CVE-2026-3592]: Limit resolver server list size.
   + [CVE-2026-3039]: Fix GSS-API resource leak.
   + [CVE-2026-5946]: Disable recursion, UPDATE, and NOTIFY for non-IN
     views.
   + [CVE-2026-5950]: Avoid unbounded recursion loop.
   + [CVE-2026-5947]: Fix crash in resolver when SIG(0)-signed responses
     are received under load.
   + [CVE-2026-3593]: Fix use-after-free error in DNS-over-HTTPS when
     processing HTTP/2 SETTINGS frames.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 May 2026 11:42:43 +0200

bind9 (1:9.20.22-1) unstable; urgency=medium

  * New upstream version 9.20.22

 -- Ondřej Surý <ondrej@debian.org>  Wed, 01 Apr 2026 16:58:56 +0200

bind9 (1:9.20.21-1) unstable; urgency=high

  * New upstream version 9.20.21
   - [CVE-2026-1519]: Fix unbounded NSEC3 iterations when validating
     referrals to unsigned delegations.
   - [CVE-2026-3104]: Fix memory leaks in code preparing DNSSEC proofs of
     non-existence.
   - [CVE-2026-3119]: Prevent a crash in code processing queries
     containing a TKEY record.
   - [CVE-2026-3591]: Fix a stack use-after-return flaw in SIG(0) handling
     code.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 25 Mar 2026 16:38:18 +0100

bind9 (1:9.20.20-1) unstable; urgency=medium

  * New upstream version 9.20.20

 -- Ondřej Surý <ondrej@debian.org>  Fri, 27 Feb 2026 12:46:48 +0100

bind9 (1:9.20.19-1) unstable; urgency=medium

  * New upstream version 9.20.19

 -- Ondřej Surý <ondrej@debian.org>  Wed, 18 Feb 2026 12:28:29 +0100

bind9 (1:9.20.18-1ubuntu4) stonking; urgency=medium

  * SECURITY UPDATE: BIND 9 server memory exhaustion during GSS-API TKEY
    negotiation
    - debian/patches/CVE-2026-3039-pre1.patch: Release gnamebuf also on the
      error path in lib/dns/gssapictx.c.
    - debian/patches/CVE-2026-3039-1.patch: Fix GSS-API context leak in TKEY
      negotiation in lib/dns/gssapictx.c, lib/dns/include/dst/gssapi.h,
      lib/dns/tkey.c.
    - debian/patches/CVE-2026-3039-3.patch: Fix output token and GSS context
      leaks in TKEY/GSS-API error paths in lib/dns/gssapictx.c,
      lib/dns/tkey.c.
    - CVE-2026-3039
  * SECURITY UPDATE: Amplification vulnerabilities via self-pointed glue
    records
    - debian/patches/CVE-2026-3592-1.patch: Limit the number of addresses
      returned per ADB find in bin/named/main.c, lib/dns/adb.c.
    - debian/patches/CVE-2026-3592-2.patch: Remove duplicate addresses from
      the resolver SLIST in lib/dns/resolver.c.
    - debian/patches/CVE-2026-3592-3.patch: Add system test for self-pointed
      glue deduplication in bin/tests/system/selfpointedglue/ns1/named.conf.j2,
      bin/tests/system/selfpointedglue/ns1/root.db,
      bin/tests/system/selfpointedglue/ns2/named.conf.j2,
      bin/tests/system/selfpointedglue/ns2/tld.db,
      bin/tests/system/selfpointedglue/ns3/example.tld.db,
      bin/tests/system/selfpointedglue/ns3/example2.tld.db,
      bin/tests/system/selfpointedglue/ns3/named.conf.j2,
      bin/tests/system/selfpointedglue/ns4/named.args.j2,
      bin/tests/system/selfpointedglue/ns4/named.conf.j2,
      bin/tests/system/selfpointedglue/ns4/root.hint,
      bin/tests/system/selfpointedglue/tests_selfpointedglue.py.
    - debian/patches/CVE-2026-3592-4.patch: Add SRTT-based server selection
      system test in bin/tests/system/srtt/README,
      bin/tests/system/srtt/ans2/ans.py, bin/tests/system/srtt/ans3/ans.py,
      bin/tests/system/srtt/ans4/ans.py, bin/tests/system/srtt/ans5/ans.py,
      bin/tests/system/srtt/ns1/named.conf.j2,
      bin/tests/system/srtt/ns1/root.db, bin/tests/system/srtt/ns6/named.args,
      bin/tests/system/srtt/ns6/named.conf.j2,
      bin/tests/system/srtt/srtt_ans.py, bin/tests/system/srtt/tests_srtt.py.
    - CVE-2026-3592
  * SECURITY UPDATE: Heap use-after-free vulnerability in BIND 9
    DNS-over-HTTPS implementation
    - debian/patches/CVE-2026-3593-1.patch: Add system test for HTTP/2
      SETTINGS frame flood in bin/tests/system/doth/tests_malicious.py.
    - debian/patches/CVE-2026-3593-2.patch: Fix use-after-free in DoH write
      buffer after HTTP/2 send in lib/isc/netmgr/http.c.
    - CVE-2026-3593
  * SECURITY UPDATE: Invalid handling of CLASS != IN
    - debian/patches/CVE-2026-5946-1.patch: Disable recursion for non-IN
      classes in bin/named/server.c, lib/isccfg/check.c.
    - debian/patches/CVE-2026-5946-2.patch: Disable UPDATE and NOTIFY for
      non-IN classes in bin/named/server.c, lib/dns/adb.c,
      lib/ns/client.c, lib/ns/update.c.
    - debian/patches/CVE-2026-5946-3.patch: Validate DNS message CLASS early
      in request processing in bin/tests/system/unknown/tests.sh,
      lib/ns/client.c.
    - debian/patches/CVE-2026-5946-4.patch: Reject meta-classes in UPDATE and
      NOTIFY messages in lib/dns/message.c.
    - debian/patches/CVE-2026-5946-5.patch: Skip "deny-answer-address" for
      non-IN addresses in lib/dns/resolver.c.
    - debian/patches/CVE-2026-5946-6.patch: Test CHAOS view recursion behavior
      in bin/tests/system/checkconf/tests.sh,
      bin/tests/system/checkconf/warn-chaos-recursion.conf,
      bin/tests/system/class/ns1/chaos.db.in,
      bin/tests/system/class/ns1/named.conf.j2,
      bin/tests/system/class/ns2/example.db.in,
      bin/tests/system/class/ns2/localhost.db.in,
      bin/tests/system/class/ns2/named.conf.j2,
      bin/tests/system/class/ns3/named.conf.j2, bin/tests/system/class/setup.sh,
      bin/tests/system/class/tests_class_chaos.py,
      bin/tests/system/isctest/check.py.
    - debian/patches/CVE-2026-5946-7.patch: Test UPDATE behavior in CHAOS and
      other non-IN classes in bin/named/server.c,
      bin/tests/system/class/ns2/localhost.db.in,
      bin/tests/system/class/tests_class_update.py.
    - debian/patches/CVE-2026-5946-8.patch: Test server behavior when sending
      various UPDATE requests in bin/tests/system/class/tests_class_update.py,
      bin/tests/system/nsupdate/setup.sh, bin/tests/system/nsupdate/tests.sh,
      bin/tests/system/packet.pl.
    - debian/patches/CVE-2026-5946-9.patch: Make the RD flag optional in
      isctest.query() in bin/tests/system/isctest/query.py.
    - CVE-2026-5946
  * SECURITY UPDATE: SIG(0) validation during query flood may lead to
    undefined behavior
    - debian/patches/CVE-2026-5947.patch: Fix use-after-free in resolver SIG(0)
      async verification path in lib/dns/resolver.c.
    - CVE-2026-5947
  * SECURITY UPDATE: Unbounded resend loop in BIND 9 resolver
    - debian/patches/CVE-2026-5950-1.patch: Add reproducer for BADCOOKIE
      resend loop in bin/tests/system/resend_loop/ans3/ans.py,
      bin/tests/system/resend_loop/ns4/named.conf.j2,
      bin/tests/system/resend_loop/ns4/root.hint,
      bin/tests/system/resend_loop/tests_resend_loop.py.
    - debian/patches/CVE-2026-5950-2.patch: Refactor incrementing query
      counters in lib/dns/resolver.c.
    - debian/patches/CVE-2026-5950-3.patch: rctx_resend() increment query
      counters in lib/dns/resolver.c.
    - CVE-2026-5950
  * d/p/CVE-2026-1519-1.patch, d/p/CVE-2026-3104-1.patch: disable patches,
    quilt doesn't like patches that create symlinks apparently.

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 21 May 2026 08:23:48 -0400

bind9 (1:9.20.18-1ubuntu3) stonking; urgency=medium

  * d/bind9.maintscript: rm_conffile for incompatible named.conf
    (LP: #2150582)

 -- Hector Cao <hector.cao@canonical.com>  Thu, 30 Apr 2026 16:36:00 +0200

bind9 (1:9.20.18-1ubuntu2) resolute; urgency=medium

  * SECURITY UPDATE: Excessive NSEC3 iterations cause high CPU load during
    insecure delegation validation
    - debian/patches/CVE-2026-1519-1.patch: add reproducers to bin/tests/*.
    - debian/patches/CVE-2026-1519-2.patch: check iterations in
      isdelegation() in lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-3.patch: don't verify already trusted
      rdatasets in lib/dns/include/dns/types.h, lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-4.patch: combine validator_log and
      marksecure in lib/dns/validator.c.
    - debian/patches/CVE-2026-1519-5.patch: check RRset trust in
      validate_neg_rrset() in lib/dns/validator.c.
    - CVE-2026-1519
  * SECURITY UPDATE: Memory leak in code preparing DNSSEC proofs of
    non-existence
    - debian/patches/CVE-2026-3104-1.patch: add tests to bin/tests/*.
    - debian/patches/CVE-2026-3104-2.patch: fix memory leak in QPcache
      addnoqname/addclosest mechanism in lib/dns/qpcache.c,
      lib/dns/rbtdb.c.
    - CVE-2026-3104
  * SECURITY UPDATE: Authenticated query containing a TKEY record may cause
    named to terminate unexpectedly
    - debian/patches/CVE-2026-3119-1.patch: add tests to bin/tests/*.
    - debian/patches/CVE-2026-3119-2.patch: fix a bug in
      dns_tkey_processquery() in lib/dns/tkey.c.
    - CVE-2026-3119
  * SECURITY UPDATE: A stack use-after-return flaw in SIG(0) handling code
    may enable ACL bypass
    - debian/patches/CVE-2026-3591-1.patch: add tests to bin/tests/*.
    - debian/patches/CVE-2026-3591-2.patch: fix stack Use-After-Return in
      SIG(0) handling in bin/named/server.c.
    - CVE-2026-3591

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 27 Mar 2026 11:00:11 -0400

bind9 (1:9.20.18-1ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable (LP: #2125995). Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
  * Drop Changes:
    - d/p/CVE-2025-8677.patch
    - d/p/CVE-2025-40778.patch
    - d/p/CVE-2025-40780.patch
    [Fixed in 9.20.15]
  * Added:
    - d/e/apparmor.d/usr.sbin.named: Allow read access to
      /proc/version_signature for named (LP: #2119320).

 -- Lena Voytek <lena.voytek@canonical.com>  Fri, 06 Feb 2026 16:05:33 -0500

bind9 (1:9.20.18-1) unstable; urgency=medium

  * New upstream version 9.20.18
   + [CVE-2025-13878]: Fix incorrect length checks for BRID and HHIT
     records.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Jan 2026 16:47:34 +0100

bind9 (1:9.20.17-1) unstable; urgency=medium

  * New upstream version 9.20.17

 -- Ondřej Surý <ondrej@debian.org>  Wed, 17 Dec 2025 16:32:20 +0100

bind9 (1:9.20.16-1) unstable; urgency=medium

  * New upstream version 9.20.16

 -- Ondřej Surý <ondrej@debian.org>  Wed, 19 Nov 2025 18:06:11 +0100

bind9 (1:9.20.15-2) unstable; urgency=medium

  * Remove libdb-dev build depends (Closes: #1119196)

 -- Ondřej Surý <ondrej@debian.org>  Tue, 28 Oct 2025 07:28:58 +0100

bind9 (1:9.20.15-1) unstable; urgency=medium

  * New upstream version 9.20.15
   - [CVE-2025-8677]: DNSSEC validation fails if matching but invalid
     DNSKEY is found
   - [CVE-2025-40778]: Address various spoofing attacks.
   - [CVE-2025-40780]: Cache-poisoning due to weak pseudo-random number
     generator

 -- Ondřej Surý <ondrej@debian.org>  Wed, 22 Oct 2025 16:40:20 +0200

bind9 (1:9.20.13-1) unstable; urgency=medium

  * New upstream version 9.20.13

 -- Ondřej Surý <ondrej@debian.org>  Wed, 10 Sep 2025 20:31:08 +0200

bind9 (1:9.20.12-1) unstable; urgency=medium

  * New upstream version 9.20.12

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 Aug 2025 17:22:43 +0200

bind9 (1:9.20.11-4) unstable; urgency=medium

  * Remove named.conf.default-zones.dpkg-dist from /etc/bind

 -- Ondřej Surý <ondrej@debian.org>  Sun, 27 Jul 2025 12:04:56 +0200

bind9 (1:9.20.11-3) unstable; urgency=medium

  * Remove the /etc/bind/named.conf.default-zones again from the
    maintainer script as it might have been reinstalled by
    accident. (Closes: #1108945)

 -- Ondřej Surý <ondrej@debian.org>  Sun, 27 Jul 2025 07:54:24 +0200

bind9 (1:9.20.11-2) unstable; urgency=high

  * Remove /etc/bind/named.conf.default-zones from the package as
    the intent was to remove this file.  (Closes: #1108945)
  * Add new /etc/bind/named.conf.root-hints file that makes 'named'
    to use root.hints from dns-root-data again.

 -- Ondřej Surý <ondrej@debian.org>  Sun, 27 Jul 2025 06:48:59 +0200

bind9 (1:9.20.11-1ubuntu3) resolute; urgency=medium

  * SECURITY UPDATE: Resource exhaustion via malformed DNSKEY handling
    - debian/patches/CVE-2025-8677.patch: count invalid keys as validation
      failures in lib/dns/validator.c.
    - CVE-2025-8677
  * SECURITY UPDATE: Cache poisoning attacks with unsolicited RRs
    - debian/patches/CVE-2025-40778.patch: no longer accept DNAME records
      or extraneous NS records in the AUTHORITY section unless these are
      received via spoofing-resistant transport in doc/arm/reference.rst,
      lib/dns/include/dns/message.h, lib/dns/message.c, lib/dns/resolver.c.
    - CVE-2025-40778
  * SECURITY UPDATE: Cache poisoning due to weak PRNG
    - debian/patches/CVE-2025-40780.patch: change internal random generator
      to a cryptographically secure pseudo-random generator in
      configure.ac, lib/isc/Makefile.am, lib/isc/hash.c, lib/isc/hashmap.c,
      lib/isc/include/isc/nonce.h, lib/isc/include/isc/random.h,
      lib/isc/random.c, tests/isc/random_test.c.
    - CVE-2025-40780

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 21 Oct 2025 07:57:20 -0400

bind9 (1:9.20.11-1ubuntu2) questing; urgency=medium

  * Rebuild to include updated RISC-V base ISA RVA23

 -- Heinrich Schuchardt <heinrich.schuchardt@canonical.com>  Wed, 03 Sep 2025 15:03:19 +0000

bind9 (1:9.20.11-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler (universe packages)
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
  * Drop changes:
    - dyndb-ldap test: bind-dyndb-ldap likely will not return to the archive,
      and if it is this test can be re-added manually:
      + d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650)
      + d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed
        from Ubuntu for now (LP #2078003).
    - bind9-libs: Hard-code libuv1t64 instead of libuv1 - no longer needed.

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 24 Jul 2025 13:50:58 -0400

bind9 (1:9.20.11-1) unstable; urgency=high

  * New upstream version 9.20.11
   + [CVE2025-40777]: Fix a possible assertion failure when
     stale-answer-client-timeout is set to 0.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Jul 2025 17:08:46 +0200

bind9 (1:9.20.10-1ubuntu1) questing; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler (universe packages)
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
    - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650)
    - d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed
      from Ubuntu for now (LP #2078003).
    - bind9-libs: Hard-code libuv1t64 instead of libuv1.

 -- Lena Voytek <lena.voytek@canonical.com>  Mon, 23 Jun 2025 09:41:50 -0400

bind9 (1:9.20.10-1) unstable; urgency=medium

  * New upstream version 9.20.10

 -- Ondřej Surý <ondrej@debian.org>  Fri, 20 Jun 2025 06:25:07 +0200

bind9 (1:9.20.9-2ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2110436). Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler (universe packages)
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
    - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650)
    - d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed
      from Ubuntu for now (LP #2078003).
    - bind9-libs: Hard-code libuv1t64 instead of libuv1.
  * Drop Changes:
    - Improve dep-8 test suite (LP #2003584):
      + d/t/zonetest: Add dep8 test for checking the domain zone creation process
      + d/t/control: Add new test outline
    - d/po/de.po: Fix German UTF-8 encoding
    - d/control: Remove lsb-base dependency as it is no longer needed
      + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019851
    - d/copyright: Fix lintian warnings
    [Added to Debian]
    - d/p/CVE-2025-40775.patch
    [Fixed in 9.20.9]

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 05 Jun 2025 13:34:24 -0400

bind9 (1:9.20.9-2) unstable; urgency=low

  * Fix the default branch in the Vcs-Git field (Closes: #1106677)

 -- Ondřej Surý <ondrej@debian.org>  Wed, 28 May 2025 13:39:20 +0200

bind9 (1:9.20.9-1) unstable; urgency=high

  * New upstream version 9.20.9
   + [CVE-2025-40775] Prevent assertion when processing TSIG algorithm.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 May 2025 13:44:48 +0200

bind9 (1:9.20.8-6) unstable; urgency=medium

  * Adjust the autopkg zonetest

 -- Ondřej Surý <ondrej@debian.org>  Fri, 18 Apr 2025 18:40:30 +0200

bind9 (1:9.20.8-5) unstable; urgency=medium

  [ Remus-Gabriel Chelu ]
  * [INTL:ro] Romanian debconf templates translation of bind9

  [ Ondřej Surý ]
  * Fix lintian mismatched-override
  * Use pkgconf instead of pkg-config
  * Remove superfluous-file-pattern(s) from d/copyright
  * Remove full path to named-checkconf in d/bind9.postinst

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Apr 2025 21:50:52 +0200

bind9 (1:9.20.8-4) unstable; urgency=medium

  [ Lena Voytek ]
  * Add zonetest DEP-8 test

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Apr 2025 21:21:42 +0200

bind9 (1:9.20.8-3) unstable; urgency=medium

  [ Lena Voytek ]
  * Fix German UTF-8 encoding
  * Clean up debian/copyright file
  * Remove lsb-base runtime dependency as it is no longer needed

  [ Santiago Ruano Rincón ]
  * Add debian/salsa-ci.yml
  * Make d/tests/validation less flaky.

  [ Carles Pina i Estany ]
  * Added po-debconf Catalan translation

  [ Mitchell Dzurick ]
  * d/control: Suggest bind9-doc over bind-doc for the bind9 package

  [ Debian Janitor ]
  * Apply multi-arch hints. + bind9-doc: Add Multi-Arch: foreign.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Apr 2025 21:07:33 +0200

bind9 (1:9.20.8-2) unstable; urgency=medium

  * Validate configuration file before service restart
    (Closes: #995310, #1054314)

 -- Ondřej Surý <ondrej@debian.org>  Thu, 17 Apr 2025 18:49:10 +0200

bind9 (1:9.20.8-1) unstable; urgency=medium

  * New upstream version 9.20.8

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Apr 2025 15:05:13 +0200

bind9 (1:9.20.7-1) unstable; urgency=medium

  * New upstream version 9.20.7

 -- Ondřej Surý <ondrej@debian.org>  Thu, 13 Mar 2025 11:37:20 +0100

bind9 (1:9.20.6-1) unstable; urgency=medium

  * Add Provides: bind9utils and Provides: dnsutils to the respective
    packages
  * New upstream version 9.20.6

 -- Ondřej Surý <ondrej@debian.org>  Wed, 19 Feb 2025 16:00:19 +0100

bind9 (1:9.20.5-1) unstable; urgency=medium

  * New upstream version 9.20.5 (Closes: #1094735)
   - CVE-2024-12705: DNS-over-HTTPS flooding fixes
   - CVE-2024-11187: Limit additional section processing for large RDATA
     sets
  * Drop libltdl-dev from Build-Depends, libuv wrappers are used
    for dlopen and friends.

 -- Ondřej Surý <ondrej@debian.org>  Mon, 27 Jan 2025 12:21:49 +0100

bind9 (1:9.20.4-4) unstable; urgency=medium

  * Revert "Temporarily use rbtdb as a zone database to prevent assertion
    failure"
  * Add pre-release patch for the NSEC3 encloser assertion failure

 -- Ondřej Surý <ondrej@debian.org>  Tue, 21 Jan 2025 16:16:07 +0100

bind9 (1:9.20.4-3ubuntu3) questing; urgency=medium

  * No-change rebuild for libxml2 soname change.

 -- Matthias Klose <doko@ubuntu.com>  Mon, 26 May 2025 14:23:49 +0200

bind9 (1:9.20.4-3ubuntu2) questing; urgency=medium

  * SECURITY UPDATE: message with invalid TSIG causes an assertion failure
    - debian/patches/CVE-2025-40775.patch: properly validate messages in
      lib/dns/include/dns/message.h, lib/dns/include/dns/tsig.h,
      lib/dns/message.c, lib/dns/tsig.c, tests/dns/tsig_test.c.
    - CVE-2025-40775

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 20 May 2025 07:25:11 -0400

bind9 (1:9.20.4-3ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085207). Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler (universe packages)
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/NEWS: mention relevant packaging changes
    - Improve dep-8 test suite (LP #2003584):
      + d/t/zonetest: Add dep8 test for checking the domain zone creation process
      + d/t/control: Add new test outline
    - d/po/de.po: Fix German UTF-8 encoding
    - d/copyright: Fix lintian warnings
      + Remove the entry for lib/isc/hp.c lib/isc/include/isc/hp.h as they were
        deleted in 9.18.2
      + Remove the entry for lib/isc/include/pkcs11/pkcs11.h as it is no longer
        bundled as of 9.17.19
      + Update the location of random_test.c and add info about its public
        domain section
      + Add wildcards to folders as needed
      + Note that m4/ uses the FSFAP license
    - d/control: Remove lsb-base dependency as it is no longer needed
      + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019851
    - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650), but disable it
      as bind-dyndb-ldap has been removed from Ubuntu for now (LP #2078003).
    - bind9-libs: Hard-code libuv1t64 instead of libuv1.
  * Drop Changes:
    - d/p/stop-using-malloc_usable_size.patch: Fixed upstream -
      https://gitlab.isc.org/isc-projects/bind9/-/issues/4880
    - libjemalloc-dev dependency removal: Re-added as jemalloc is now in main
      (LP 2088056).

 -- Lena Voytek <lena.voytek@canonical.com>  Thu, 09 Jan 2025 15:52:20 -0500

bind9 (1:9.20.4-3) unstable; urgency=high

  * Temporarily use rbtdb as a zone database as workaround for an upstream
    bug.

 -- Ondřej Surý <ondrej@debian.org>  Thu, 19 Dec 2024 05:56:30 +0100

bind9 (1:9.20.4-2) unstable; urgency=medium

  * Add upstream patch for the new GLUE cache implementation

 -- Ondřej Surý <ondrej@debian.org>  Sun, 15 Dec 2024 08:02:25 +0100

bind9 (1:9.20.4-1) unstable; urgency=medium

  * New upstream version 9.20.4

 -- Ondřej Surý <ondrej@debian.org>  Wed, 11 Dec 2024 17:35:53 +0100

bind9 (1:9.20.3-1) unstable; urgency=medium

  * New upstream version 9.20.3

 -- Ondřej Surý <ondrej@debian.org>  Thu, 10 Oct 2024 10:37:54 +0200

bind9 (1:9.20.2-1) unstable; urgency=medium

  * New upstream version 9.20.2

 -- Ondřej Surý <ondrej@debian.org>  Fri, 20 Sep 2024 14:35:10 +0200

bind9 (1:9.20.1-1) unstable; urgency=medium

  * New upstream version 9.20.1

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Aug 2024 15:07:52 +0200

bind9 (1:9.20.0-2ubuntu3) oracular; urgency=medium

  * d/t/control: Disable dyndb-ldap test as bind-dyndb-ldap has been removed
    from Ubuntu for now (LP: #2078003).

 -- Lena Voytek <lena.voytek@canonical.com>  Wed, 28 Aug 2024 07:52:29 -0700

bind9 (1:9.20.0-2ubuntu2) oracular; urgency=medium

  * d/p/stop-using-malloc_usable_size.patch: Fix buffer overflows by removing
    memory size check implementations based on malloc_usable_size and
    malloc_size (LP: #2077327).

 -- Lena Voytek <lena.voytek@canonical.com>  Mon, 26 Aug 2024 11:23:58 -0700

bind9 (1:9.20.0-2ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable to update to new 9.20 LTS
    Upstream release info: https://www.isc.org/blogs/2024-bind920/
  * Remaining changes:
    - Don't build dnstap as it depends on universe packages:
      + d/control: drop build-depends on libfstrm-dev, libprotobuf-c-dev and
        protobuf-c-compiler (universe packages)
      + d/dnsutils.install: don't install dnstap
      + d/rules: don't build dnstap nor install dnstap.proto
    - Add back apport:
      + d/bind9.apport: add back old bind9 apport hook, but without calling
        attach_conffiles() since that is already done by apport itself, with
        confirmation from the user.
      + d/control, d/rules: build-depends on dh-apport and use it
    - d/control: remove optional libjemalloc-dev Build-Depends as it is not in
      main.
    - d/NEWS: mention relevant packaging changes
    - Improve dep-8 test suite (LP #2003584):
      + d/t/zonetest: Add dep8 test for checking the domain zone creation process
      + d/t/control: Add new test outline
    - d/po/de.po: Fix German UTF-8 encoding
    - d/copyright: Fix lintian warnings
      + Remove the entry for lib/isc/hp.c lib/isc/include/isc/hp.h as they were
        deleted in 9.18.2
      + Remove the entry for lib/isc/include/pkcs11/pkcs11.h as it is no longer
        bundled as of 9.17.19
      + Update the location of random_test.c and add info about its public
        domain section
      + Add wildcards to folders as needed
      + Note that m4/ uses the FSFAP license
    - d/control: Remove lsb-base dependency as it is no longer needed
      + See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019851
    - d/t/control, d/t/dyndb-ldap: add DEP8 test (LP #2032650)
    - bind9-libs: Hard-code libuv1t64 instead of libuv1.
  * Dropped Changes:
    - d/p/always-use-standard-library-stdatomic.patch: Fixed upstream

 -- Lena Voytek <lena.voytek@canonical.com>  Mon, 12 Aug 2024 11:47:50 -0700

bind9 (1:9.20.0-2) unstable; urgency=medium

  * Fix the assertion failure in samba-libs DLZ module. (Closes: #1074378)

 -- Ondřej Surý <ondrej@debian.org>  Sat, 27 Jul 2024 05:02:39 +0200

bind9 (1:9.20.0-1) unstable; urgency=high

  * New upstream version 9.20.0
   - CVE-2024-0760: A flood of DNS messages over TCP may make the server
     unstable
   - CVE-2024-1737: BIND's database will be slow if a very large number of
     RRs exist at the same name
   - CVE-2024-1975: SIG(0) can be used to exhaust CPU resources
   - CVE-2024-4076: Assertion failure when serving both stale cache data
     and authoritative zone content

 -- Ondřej Surý <ondrej@debian.org>  Tue, 16 Jul 2024 17:26:47 +0200

bind9 (1:9.19.24-185-g392e7199df2-1) unstable; urgency=medium

  * New upstream version 9.19.24-185-g392e7199df2

 -- Ondřej Surý <ondrej@debian.org>  Thu, 20 Jun 2024 15:11:56 +0200

bind9 (1:9.19.24-2) unstable; urgency=medium

  * Add dnssec-ksr tool to bind9-utils package

 -- Ondřej Surý <ondrej@debian.org>  Wed, 15 May 2024 20:59:35 +0200

bind9 (1:9.19.24-1) unstable; urgency=medium

  * New upstream version 9.19.24

 -- Ondřej Surý <ondrej@debian.org>  Wed, 15 May 2024 19:55:59 +0200

bind9 (1:9.19.23-1) unstable; urgency=medium

  * New upstream version 9.19.23

 -- Ondřej Surý <ondrej@debian.org>  Wed, 17 Apr 2024 23:48:03 +0200

bind9 (1:9.19.22-1) unstable; urgency=medium

  * New upstream version 9.19.22
   - A regression caused by CVE-2023-6516 fix could lead into
     an out-of-memory condition when the server is under heavy
     load.

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 Mar 2024 14:17:43 +0100

bind9 (1:9.19.21-1) unstable; urgency=high

  [ Helmut Grohne ]
  * Drop unused Build-Depends: python3. (Closes: #1063448)

  [ Ondřej Surý ]
  * New upstream version 9.19.21
   - CVE-2023-4408: Parsing large DNS messages may cause excessive CPU
     load
   - CVE-2023-5517: Querying RFC 1918 reverse zones may cause an assertion
     failure when "nxdomain-redirect" is enabled
   - CVE-2023-5679: Enabling both DNS64 and serve-stale may cause an
     assertion failure during recursive resolution
   - CVE-2023-6516: Specific recursive query patterns may lead to an
     out-of-memory condition
   - CVE-2023-50387: KeyTrap - Extreme CPU consumption in DNSSEC validator
   - CVE-2023-50868: Preparing an NSEC3 closest encloser proof can exhaust
     CPU resources

 -- Ondřej Surý <ondrej@debian.org>  Mon, 12 Feb 2024 17:04:19 +0100

bind9 (1:9.19.19-1) unstable; urgency=medium

  [ Ondřej Surý ]
  * New upstream version 9.19.19

  [ Bernhard Schmidt ]
  * Sync 9.18 to 9.19 (Closes: #1056984)

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 Dec 2023 17:01:32 +0100

bind9 (1:9.19.18-1) unstable; urgency=medium

  * New upstream version 9.19.18

 -- Ondřej Surý <ondrej@debian.org>  Wed, 15 Nov 2023 17:51:18 +0100

bind9 (1:9.19.17-1) unstable; urgency=medium

  * New upstream version 9.19.17
   - CVE-2023-3341: A stack exhaustion flaw in control channel code may
     cause named to terminate unexpectedly (Closes: #1052416)
   - CVE-2023-4236: named may terminate unexpectedly under high
     DNS-over-TLS query load (Closes: #1052417)

 -- Ondřej Surý <ondrej@debian.org>  Wed, 20 Sep 2023 18:13:07 +0200

bind9 (1:9.19.16-1) experimental; urgency=medium

  * New upstream version 9.19.16

 -- Ondřej Surý <ondrej@debian.org>  Wed, 16 Aug 2023 17:54:24 +0200

bind9 (1:9.19.15-1) experimental; urgency=medium

  * New upstream version 9.19.15

 -- Ondřej Surý <ondrej@debian.org>  Wed, 19 Jul 2023 14:16:46 +0200

bind9 (1:9.19.14-1) experimental; urgency=medium

  * New upstream version 9.19.14

 -- Ondřej Surý <ondrej@debian.org>  Wed, 21 Jun 2023 21:00:01 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog bind9-libs`.
