[ 08:18:45 dougb ] bind9dns Completely new version of the BIND DNS suite with updated DNSSEC
bind94dns The BIND DNS suite with updated DNSSEC and threads
bind95dns The BIND DNS suite with updated DNSSEC and threads
bind96dns BIND DNS suite with updated DNSSEC and threads
Update to the -P1 versions of the current BIND ports which contain
the fix for the following vulnerability: https://www.isc.org/node/373
Return values from OpenSSL library functions EVP_VerifyFinal()
and DSA_do_verify() were not checked properly.
It is theoretically possible to spoof answers returned from
zones using the DNSKEY algorithms DSA (3) and NSEC3DSA (6).
In short, if you're not using DNSSEC to verify signatures you have
nothing to worry about.
While I'm here, address the issues raised in the PR by adding a knob
to disable building with OpenSSL altogether (which eliminates DNSSEC
capability), and fix the configure arguments to better deal with the
situation where the user has ssl bits in both the base and LOCALBASE.
Submitted by: Ronald F.Guilmette <email@example.com>