Corrective updates have been released for stable branches of BIND DNS Server 9.16.28 and 9.18.3, along with a new release of the experimental branch 9.19.1. Versions 9.18.3 and 9.19.1 address a vulnerability (CVE-2022-1183) in the DNS-over-HTTPS mechanism, supported since branch 9.18. This vulnerability can lead to the unexpected termination of the named process if the TLS connection to the HTTP-based handler is prematurely closed. The issue only affects serversservers handling DNS over HTTPS (DoH) requests. Servers that receive requests via DNS over TLS (DoT) and do not use DoH are not affected by the issue.
The 9.18.3 release also includes several functional improvements. Support for version two of 'Catalog Zones', defined in the fifth draft of the IETF specification, has been added. Catalog Zones provides a new method of managing secondary DNS servers, where instead of defining individual records for each secondary zone on the secondary server, a transfer of a specific set of secondary zones is organized between the primary and secondary servers. That is, by configuring catalog transfer similar to transferring individual zones, zones created on the primary server marked as belonging to the catalog will automatically be created on the secondary server without the need to modify configuration files.
The new version also introduces support for extended error codes 'Stale Answer' and 'Stale NXDOMAIN Answer', issued when an outdated response is returned from the cache. In named and dig, the ability to verify external for TLS certificates, which can be used to organize strict or cooperative authentication based on TLS (RFC 9103).
Source: opennet.ru
