regen master

diff --git a/doc/arm/Bv9ARM.ch08.html b/doc/arm/Bv9ARM.ch08.html
index a3793be37746b4475afda0bd004c5dd3382a7d9c..f18fcc5728ed7e1c294ae159a6d435eeb6472929 100644 (file)
--- a/doc/arm/Bv9ARM.ch08.html
+++ b/doc/arm/Bv9ARM.ch08.html
@@ -131,7 +131,17 @@
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+       <p>
+         When answering authoritative queries, <span class="command"><strong>named</strong></span>
+         does not return the target of a cross-zone CNAME between two
+         locally served zones; this prevents accidental cache poisoning.
+         This same restriction was incorrectly applied to recursive
+         queries as well; this has been fixed. [RT #47078]
+       </p>
+      </li>
+<li class="listitem">
        <p>
          Attempting to validate improperly unsigned CNAME responses
          from secure zones could cause a validator loop. This caused
@@ -139,7 +149,8 @@
          of encountering the crash bug described in CVE-2017-3145.
          [RT #46839]
        </p>
-      </li></ul></div>
+      </li>
+</ul></div>
   </div>
 
   <div class="section">

diff --git a/doc/arm/notes.html b/doc/arm/notes.html
index 3dfe655e9ba6922056efa694100302d32cd6a8b4..4a1c80f3f3704ec8ec32c91b0cd878953094a6df 100644 (file)
--- a/doc/arm/notes.html
+++ b/doc/arm/notes.html
@@ -93,7 +93,17 @@
   <div class="section">
 <div class="titlepage"><div><div><h3 class="title">
 <a name="relnotes_bugs"></a>Bug Fixes</h3></div></div></div>
-    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">
+    <div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; ">
+<li class="listitem">
+       <p>
+         When answering authoritative queries, <span class="command"><strong>named</strong></span>
+         does not return the target of a cross-zone CNAME between two
+         locally served zones; this prevents accidental cache poisoning.
+         This same restriction was incorrectly applied to recursive
+         queries as well; this has been fixed. [RT #47078]
+       </p>
+      </li>
+<li class="listitem">
        <p>
          Attempting to validate improperly unsigned CNAME responses
          from secure zones could cause a validator loop. This caused
@@ -101,7 +111,8 @@
          of encountering the crash bug described in CVE-2017-3145.
          [RT #46839]
        </p>
-      </li></ul></div>
+      </li>
+</ul></div>
   </div>
 
   <div class="section">