From: Evan Hunt <each@isc.org>
Date: Fri, 10 Jul 2020 21:14:07 +0000 (-0700)
Subject: Add CHANGES and release note for GL #1997
X-Git-Tag: v9.17.4~9^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a3e42f8599ac33b1bf0256e29bdab50c0340ad0f;p=thirdparty%2Fbind9.git

Add CHANGES and release note for GL #1997
---

diff --git a/CHANGES b/CHANGES
index 855a42e48b2..902e52fbd81 100644
--- a/CHANGES
+++ b/CHANGES
@@ -16,7 +16,9 @@
 
 5480.	[placeholder]
 
-5479.	[placeholder]
+5479.	[security]	named could crash in certain query resolution scenarios
+			where QNAME minimization and forwarding were both
+			enabled. (CVE-2020-8621) [GL #1997]
 
 5478.	[security]	It was possible to trigger an assertion failure by
 			sending a specially crafted large TCP DNS message.
diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 0b210895086..7fc7d91bd8e 100644
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -20,6 +20,15 @@ Security Fixes
   ISC would like to thank Emanuel Almeida of Cisco Systems, Inc. for
   bringing this vulnerability to our attention. [GL #1996]
 
+- ``named`` could crash after failing an assertion check in certain
+  query resolution scenarios where QNAME minimization and forwarding
+  were both enabled. To prevent such crashes, QNAME minimization is now
+  always disabled for a given query resolution process, if forwarders
+  are used at any point. This was disclosed in CVE-2020-8621.
+
+  ISC would like to thank Joseph Gullo for bringing this vulnerability
+  to our attention. [GL #1997]
+
 Known Issues
 ~~~~~~~~~~~~