add CHANGES and release notes entries

(cherry picked from commit 354ad18a12e84e5c660ce8e08e56382e529d8b2c)

diff --git a/CHANGES b/CHANGES
index bad641724d7646ce60e128d3fa676254b3532440..462f4ea486e831f7accd2d6542673ac3aef90fda 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -36,6 +36,10 @@
 5143.  [bug]           dnssec-keymgr and dnssec-coverage failed to find
                        key files for zone names ending in ".". [GL #560]
 
+5141.  [security]      Zone transfer controls for writable DLZ zones were
+                       not effective as the allowzonexfr method was not being
+                       called for such zones. (CVE-2019-6465) [GL #790]
+
 5140.  [bug]           Don't immediately mark existing keys as inactive and
                        deleted when running dnssec-keymgr for the first
                        time. [GL #117]

diff --git a/doc/arm/notes.xml b/doc/arm/notes.xml
index edb202459427c55f332fd8b10dcc5b91a88ef02b..ad4b34c77d8704131351cd800ab3583c0efaaf81 100644 (file)
--- a/doc/arm/notes.xml
+++ b/doc/arm/notes.xml
@@ -123,6 +123,14 @@
          [GL #772]
        </para>
       </listitem>
+      <listitem>
+       <para>
+         Zone transfer controls for writable DLZ zones were not
+         effective as the <command>allowzonexfr</command> method was
+         not being called for such zones. This flaw is disclosed in
+         CVE-2019-6465. [GL #790]
+       </para>
+      </listitem>
     </itemizedlist>
   </section>