From: Ondřej Surý <ondrej@isc.org>
Date: Wed, 11 Oct 2023 07:15:13 +0000 (+0200)
Subject: Add CHANGES and release note for [GL #4234]
X-Git-Tag: v9.19.21~11^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=30d27928cff8a82774131b401c26b171a2367e31;p=thirdparty%2Fbind9.git

Add CHANGES and release note for [GL #4234]
---

diff --git a/CHANGES b/CHANGES
index b524775c099..d3d5fa5a6e2 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,7 +6,8 @@
 
 6316.	[placeholder]
 
-6315.	[placeholder]
+6315.	[security]	Speed up parsing of DNS messages with many different
+			names. (CVE-2023-4408) [GL #4234]
 
 6314.	[bug]		Address race conditions in dns_tsigkey_find().
 			[GL #4182]
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index bebf1cd3b79..518a160826d 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -15,7 +15,13 @@ Notes for BIND 9.19.20
 Security Fixes
 ~~~~~~~~~~~~~~
 
-- None.
+- Parsing DNS messages with many different names could cause excessive
+  CPU load. This has been fixed. :cve:`2023-4408`
+
+  ISC would like to thank Shoham Danino from Reichman University, Anat
+  Bremler-Barr from Tel-Aviv University, Yehuda Afek from Tel-Aviv
+  University, and Yuval Shavitt from Tel-Aviv University for bringing
+  this vulnerability to our attention. :gl:`#4234`
 
 New Features
 ~~~~~~~~~~~~