Security update for bind SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2026:20039-1 Final 1 1 2026-01-15T10:43:49Z current 2026-01-15T10:43:49Z 2026-01-15T10:43:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for bind This update for bind fixes the following issues: - Upgrade to release 9.20.15 Security Fixes: * CVE-2025-40778: Fixed cache poisoning attacks with unsolicited RRs (bsc#1252379) * CVE-2025-40780: Fixed cache poisoning due to weak PRNG (bsc#1252380) * CVE-2025-8677: Fixed resource exhaustion via malformed DNSKEY handling (bsc#1252378) New Features: * Add dnssec-policy keys configuration check to named-checkconf. * Add a new option `manual-mode` to dnssec-policy. * Add a new option `servfail-until-ready` to response-policy zones. * Support for parsing HHIT and BRID records has been added. * Support for parsing DSYNC records has been added. Removed Features: * Deprecate the `tkey-gssapi-credential` statement. * Obsolete the `tkey-domain` statement. Feature Changes: * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1. Bug Fixes: * Missing DNSSEC information when CD bit is set in query. * rndc sign during ZSK rollover will now replace signatures. * Use signer name when disabling DNSSEC algorithms. * Preserve cache when reload fails and reload the server again. * Prevent spurious SERVFAILs for certain 0-TTL resource records. * Fix unexpected termination if catalog-zones had undefined `default-primaries`. * Stale RRsets in a CNAME chain were not always refreshed. * Add RPZ extended DNS error for zones with a CNAME override policy configured. * Fix dig +keepopen option. * Log dropped or slipped responses in the query-errors category. * Fix synth-from-dnssec not working in some scenarios. * Clean enough memory when adding new ADB names/entries under memory pressure. * Prevent spurious validation failures. * Ensure file descriptors 0-2 are in use before using libuv [bsc#1230649] The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Leap-16.0-144 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1230649 SUSE Bug 1230649 https://bugzilla.suse.com/1252378 SUSE Bug 1252378 https://bugzilla.suse.com/1252379 SUSE Bug 1252379 https://bugzilla.suse.com/1252380 SUSE Bug 1252380 https://www.suse.com/security/cve/CVE-2025-40778/ SUSE CVE CVE-2025-40778 page https://www.suse.com/security/cve/CVE-2025-40780/ SUSE CVE CVE-2025-40780 page https://www.suse.com/security/cve/CVE-2025-8677/ SUSE CVE CVE-2025-8677 page openSUSE Leap 16.0 bind-9.20.15-160000.1.1 bind-doc-9.20.15-160000.1.1 bind-modules-bdbhpt-9.20.15-160000.1.1 bind-modules-generic-9.20.15-160000.1.1 bind-modules-ldap-9.20.15-160000.1.1 bind-modules-mysql-9.20.15-160000.1.1 bind-modules-perl-9.20.15-160000.1.1 bind-modules-sqlite3-9.20.15-160000.1.1 bind-utils-9.20.15-160000.1.1 bind-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-doc-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-modules-bdbhpt-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-modules-generic-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-modules-ldap-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-modules-mysql-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-modules-perl-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-modules-sqlite3-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 bind-utils-9.20.15-160000.1.1 as a component of openSUSE Leap 16.0 Under certain circumstances, BIND is too lenient when accepting records from answers, allowing an attacker to inject forged data into the cache. This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. CVE-2025-40778 openSUSE Leap 16.0:bind-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-doc-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-generic-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-ldap-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-mysql-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-perl-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-sqlite3-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-utils-9.20.15-160000.1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-40778.html CVE-2025-40778 https://bugzilla.suse.com/1252379 SUSE Bug 1252379 In specific circumstances, due to a weakness in the Pseudo Random Number Generator (PRNG) that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.16.8-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. CVE-2025-40780 openSUSE Leap 16.0:bind-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-doc-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-generic-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-ldap-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-mysql-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-perl-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-sqlite3-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-utils-9.20.15-160000.1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-40780.html CVE-2025-40780 https://bugzilla.suse.com/1252380 SUSE Bug 1252380 Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. This issue affects BIND 9 versions 9.18.0 through 9.18.39, 9.20.0 through 9.20.13, 9.21.0 through 9.21.12, 9.18.11-S1 through 9.18.39-S1, and 9.20.9-S1 through 9.20.13-S1. CVE-2025-8677 openSUSE Leap 16.0:bind-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-doc-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-bdbhpt-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-generic-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-ldap-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-mysql-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-perl-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-modules-sqlite3-9.20.15-160000.1.1 openSUSE Leap 16.0:bind-utils-9.20.15-160000.1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-8677.html CVE-2025-8677 https://bugzilla.suse.com/1252378 SUSE Bug 1252378