This package provides a module which allows commands to be sent to rndc directly from Python programs.
Provides
Requires
License
MPLv2.0
Changelog
* Wed Oct 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.21
- CVE-2026-94300 bind9.16: bind: Arbitrary code execution via
GSS-TSIG UDP message replay
* Wed Oct 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.20
- CVE-2026-97313 bind9.16: bind: Denial of service via assertion
failure in RPZ query processing
* Wed Oct 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.19
- CVE-2026-96888 bind9.16: bind: Denial of Service via assertion failure
during redirect processing
* Wed Oct 21 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.18
- CVE-2026-19630 bind9.16: BIND: Denial of Service via unbounded processing of crafted DNS messages
processing of crafted DNS messages
* Fri Oct 16 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.23-0.22.17
- Fix CVE-2026-19662: NOQNAME proof use-after-free could crash recursive resolver.
* Tue Oct 06 2026 Fedor Vorobev <fvorobev@redhat.com> - 32:9.16.23-0.22-16
- Backport 'Do not use header_prev in expire_lru_headers' from upstream.
* Thu Oct 01 2026 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22-15
- Reenable unit tests during build
* Thu Sep 24 2026 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.14
- Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666)
- Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274)
- Reject oversized negative cached records early (CVE-2026-19667)
* Wed Sep 02 2026 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.13
- Add new root key 38696 into package files (RHEL-131888)
- Update built-in anchors in delv and named
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.12
- Fix NSEC3 signer validation (CVE-2026-10723)
- Resolves: RHEL-213499
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.11
- Reject out-of-zone NSEC next owner names (CVE-2026-13321)
- Resolves: RHEL-213313
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.10
- Fix CVE-2026-11622: reference-counted DNS cache slab headers
- Resolves: RHEL-213396
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.9
- Fix CVE-2026-11721: RRSIG labels validation and out-of-zone signing
- Add new unit test
- Resolves: RHEL-213406
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.8
- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
- Add upstream rpz system test
- Resolves: RHEL-213478
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.7
- Fix CVE-2026-13204: ensure NSEC/NSEC3 has matching RRSIG
- Resolves: RHEL-213478
* Mon May 25 2026 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.6
- Fix GSS-API resource leak (CVE-2026-3039)
- Invalid handling of CLASS != IN (CVE-2026-5946)
* Fri Mar 27 2026 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.5
- Prevent Denial of Service via maliciously crafted DNSSEC-validated zone
(CVE-2026-1519)
* Wed Oct 29 2025 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.4
- Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
- Address various spoofing attacks (CVE-2025-40778)
- Replace downstream fixes with upstream changes
* Wed Aug 13 2025 Petr Menšík <pemensik@redhat.com>
- Update addresses of b.root-servers.net (RHEL-18449) - 32:9.16.23-0.22.3
* Tue Feb 18 2025 Tomas Korbar <tkorbar@redhat.com> - 32:9.16.23-0.22.2
- Fix application of patch for CVE-2024-11187
- Resolves: RHEL-77103
* Wed Feb 05 2025 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22.1
- Limit additional section records CPU processing (CVE-2024-11187)
- Fix test backport changes
* Fri Aug 09 2024 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.22
- Minor fix of reclimit test backport (CVE-2024-1737)
* Wed Aug 07 2024 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.21
- Backport addition of max-records-per-type and max-records-per-type options
(CVE-2024-1737)
* Thu Jul 18 2024 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.20
- Resolve CVE-2024-1975
- Resolve CVE-2024-1737
- Resolve CVE-2024-4076
- Add ability to change runtime limits for max types and records per name
* Wed May 15 2024 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.19
- Add few more explicit conflicts with bind subpackages (RHEL-2208)
* Mon Mar 25 2024 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.18
- Prevent crashing at masterformat system test (CVE-2023-6516)
* Mon Feb 12 2024 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.17
- Prevent increased CPU load on large DNS messages (CVE-2023-4408)
- Prevent assertion failure when nxdomain-redirect is used with
RFC 1918 reverse zones (CVE-2023-5517)
- Prevent assertion failure if DNS64 and serve-stale is used (CVE-2023-5679)
- Specific recursive query patterns may lead to an out-of-memory
condition (CVE-2023-6516)
- Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387
CVE-2023-50868)
- Import tests for large DNS messages fix
- Add downstream change complementing CVE-2023-50387
* Wed Sep 20 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.16
- Limit the amount of recursion possible in control channel (CVE-2023-3341)
* Tue Jun 20 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.15
- Strengten cache cleaning to prevent overflowing configured limit
(CVE-2023-2828)
* Sat Feb 25 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.14
- Handle subtle difference between upstream and rhel (CVE-2022-3094)
* Wed Feb 08 2023 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.13
- Prevent flooding with UPDATE requests (CVE-2022-3094)
- Handle RRSIG queries when server-stale is active (CVE-2022-3736)
- Fix crash when soft-quota is reached and serve-stale is active (CVE-2022-3924)
* Tue Dec 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.12
- Include bind9.16-dnssec-utils in public repository (#2115322)
* Tue Oct 04 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.11
- Bound the amount of work performed for delegations (CVE-2022-2795)
* Thu Sep 22 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.10
- Fix possible serve-stale related crash (CVE-2022-3080)
- Fix memory leak in ECDSA verify processing (CVE-2022-38177)
- Fix memory leak in EdDSA verify processing (CVE-2022-38178)
* Mon Apr 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.9
- Tighten cache protection against record from forwarders (CVE-2021-25220)
- Include test of forwarders
* Fri Mar 25 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.8
- TCP connections with 'keep-response-order' are properly close in all cases
(CVE-2022-0396)
* Thu Jan 20 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.7
- Keep symlink to static data but keep them in package
- Workaround to RPM limitation
* Tue Jan 18 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.6
- Make doc static data bundled, omit sphinx dependency
* Wed Jan 12 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.5
- Conflict also with lite-devel and pkcs11-utils subpackages
* Tue Jan 11 2022 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.4
- Conflict with bind-devel
- Move dnssec-utils manual pages back to package with binaries
* Mon Dec 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.3
- Stop providing bind and bind-utils
* Thu Dec 02 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.2
- Move backward compatibility to shared define
* Fri Nov 19 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.1
- Update to 9.16.23 (#2024210)
* Fri Oct 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-5.1
- Fork separate bind9.16 package (#1873486)
* Wed Oct 13 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-5
- Propagate ephemeral port ranges to chroot (#2013595)
* Tue Oct 12 2021 Petr Menšík <pemensik@redhat.com> - 32:9.16.20-4
- Fixes listening on TCP in some race conditions (#1999691)
* Tue Oct 12