oss-security:

August 18, 2021, we (Internet Systems Consortium) have disclosed a
vulnerability affecting our BIND software:

   CVE-2021-25218: A too-strict assertion check could be triggered when
   responses in BIND 9.16.19 and 9.17.16 require UDP fragmentation if
   RRL is in use

   https://kb.isc.org/docs/cve-2021-25218

New versions of BIND are available from https://www.isc.org/downloads

Operators and package maintainers who prefer to apply patches selectively can
find individual vulnerability-specific patches in the "patches" subdirectory
of the release directories for our two affected release branches (9.16 and 9.17)
The BIND 9.11 branch was not affected by CVE-2021-25218.

  9.16: https://downloads.isc.org/isc/bind9/9.16.20/patches/
  9.17: https://downloads.isc.org/isc/bind9/9.17.17/patches/

With the public announcement of this vulnerability, the embargo
period is ended and any updated software packages that have been
prepared may be released.

To the packagers and redistributors of BIND 9:

We recently contacted this list with information about CVE-2021-25218,
a vulnerability affecting the 9.16.x and 9.17.x branches of BIND,
and provided new versions of the software containing a fix for that
vulnerability.

Unfortunately an issue has been discovered in the releases which
corrected that CVE bug.  The new defect is not a remotely exploitable
attack vector, and so is arguably off-topic for this list, but as we
had previously advised packagers to update their packages based on
the new versions we wanted to inform you about a problem discovered in
those versions.

The new defect arises from a failure to properly increment the API
version of the file format for zones stored in BIND's "map" format.
As a consequence of this oversight, affected servers can terminate
with an assertion failure when trying to read zone data stored in a
file written by a previous version of the software.

More complete details are available in this Operational Notification
in the ISC Knowledge Base:

    https://kb.isc.org/docs/map-zone-format-incompatibility-in-bind-9-16-20-and-9-17-17

For the benefit of packagers we have prepared patch diffs which
increment the API version of the map format.  BIND packages built
from patched source will detect that files written in obsolete
versions of the map file format are incompatible, will log a
message and move the file to an archive version, and will retransfer
the zone from its source on a primary server, which is the normally
expected behavior when the map zone file format changes.

Patches are available in the patches subdirectories of the recent
releases, i.e.:

9.16.20: https://downloads.isc.org/isc/bind9/9.16.20/patches
9.17.17: https://downloads.isc.org/isc/bind9/9.17.17/patches

We're sorry for the error and for the extra work created for those
repackaging our software.

If you have further questions about this after reading the Operational
Notification, please direct them to security-officer@isc.org

Thank you,

Michael McNally
ISC Security Officer

Done, closing.