Add CHANGES and release note for [GL #4481]

(cherry picked from commit 3e4babc58e1ed169a25ae9083f8f3c7d3e8389a3)

diff --git a/CHANGES b/CHANGES
index 09abb7e88b23d8f163f5774d15e39421423d50eb..8587a64ab939cc3d4e254bde333e48b3bca66ff1 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,8 @@
+6399.  [security]      Malicious DNS client that sends many queries over
+                       TCP but never reads responses can cause server to
+                       respond slowly or not respond at all for other
+                       clients. (CVE-2024-0760) [GL #4481]
+
 6398.  [bug]           Fix potential data races in our DoH implementation
                        related to HTTP/2 session object management and
                        endpoints set object management after reconfiguration.

diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst
index 38e66417b702509cda93fb0f965b384a057dbfbc..58fe4ad959be450abb14e7bdfb89dcc5643fc9db 100644 (file)
--- a/doc/notes/notes-current.rst
+++ b/doc/notes/notes-current.rst
@@ -15,6 +15,10 @@ Notes for BIND 9.18.28
 Security Fixes
 ~~~~~~~~~~~~~~
 
+- Malicious DNS client that sends many queries over TCP but never reads
+  responses can cause server to respond slowly or not respond at all for other
+  clients. :cve:`2024-0760` :gl:`#4481`
+
 - Named could trigger an assertion failure when looking up the NS
   records of parent zones as part of looking up DS records.  This
   has been fixed. :gl:`#4661`