Security update for bind

Announcement ID: SUSE-SU-2026:20085-1
Release Date: 2026-01-15T10:43:49Z
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2025-40778 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
  • CVE-2025-40778 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
  • CVE-2025-40778 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
  • CVE-2025-40780 ( SUSE ): 9.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
  • CVE-2025-40780 ( SUSE ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
  • CVE-2025-40780 ( NVD ): 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
  • CVE-2025-8677 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2025-8677 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2025-8677 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products:
  • SUSE Linux Enterprise Server 16.0
  • SUSE Linux Enterprise Server for SAP Applications 16.0

An update that solves three vulnerabilities and has one fix can now be installed.

Description:

This update for bind fixes the following issues:

  • Upgrade to release 9.20.15 Security Fixes:
  • CVE-2025-40778: Fixed cache poisoning attacks with unsolicited RRs (bsc#1252379)
  • CVE-2025-40780: Fixed cache poisoning due to weak PRNG (bsc#1252380)
  • CVE-2025-8677: Fixed resource exhaustion via malformed DNSKEY handling (bsc#1252378)

New Features: * Add dnssec-policy keys configuration check to named-checkconf. * Add a new option manual-mode to dnssec-policy. * Add a new option servfail-until-ready to response-policy zones. * Support for parsing HHIT and BRID records has been added. * Support for parsing DSYNC records has been added.

Removed Features: * Deprecate the tkey-gssapi-credential statement. * Obsolete the tkey-domain statement.

Feature Changes: * Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.

Bug Fixes: * Missing DNSSEC information when CD bit is set in query. * rndc sign during ZSK rollover will now replace signatures. * Use signer name when disabling DNSSEC algorithms. * Preserve cache when reload fails and reload the server again. * Prevent spurious SERVFAILs for certain 0-TTL resource records. * Fix unexpected termination if catalog-zones had undefined default-primaries. * Stale RRsets in a CNAME chain were not always refreshed. * Add RPZ extended DNS error for zones with a CNAME override policy configured. * Fix dig +keepopen option. * Log dropped or slipped responses in the query-errors category. * Fix synth-from-dnssec not working in some scenarios. * Clean enough memory when adding new ADB names/entries under memory pressure. * Prevent spurious validation failures. * Ensure file descriptors 0-2 are in use before using libuv [bsc#1230649]

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Enterprise Server 16.0
    zypper in -t patch SUSE-SLES-16.0-144=1
  • SUSE Linux Enterprise Server for SAP Applications 16.0
    zypper in -t patch SUSE-SLES-16.0-144=1

Package List:

  • SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
    • bind-modules-perl-debuginfo-9.20.15-160000.1.1
    • bind-modules-sqlite3-9.20.15-160000.1.1
    • bind-utils-9.20.15-160000.1.1
    • bind-modules-mysql-debuginfo-9.20.15-160000.1.1
    • bind-modules-generic-9.20.15-160000.1.1
    • bind-9.20.15-160000.1.1
    • bind-debugsource-9.20.15-160000.1.1
    • bind-modules-mysql-9.20.15-160000.1.1
    • bind-modules-generic-debuginfo-9.20.15-160000.1.1
    • bind-utils-debuginfo-9.20.15-160000.1.1
    • bind-modules-ldap-debuginfo-9.20.15-160000.1.1
    • bind-modules-perl-9.20.15-160000.1.1
    • bind-debuginfo-9.20.15-160000.1.1
    • bind-modules-ldap-9.20.15-160000.1.1
    • bind-modules-sqlite3-debuginfo-9.20.15-160000.1.1
  • SUSE Linux Enterprise Server 16.0 (noarch)
    • bind-doc-9.20.15-160000.1.1
  • SUSE Linux Enterprise Server for SAP Applications 16.0 (ppc64le x86_64)
    • bind-modules-perl-debuginfo-9.20.15-160000.1.1
    • bind-modules-sqlite3-9.20.15-160000.1.1
    • bind-utils-9.20.15-160000.1.1
    • bind-modules-mysql-debuginfo-9.20.15-160000.1.1
    • bind-modules-generic-9.20.15-160000.1.1
    • bind-9.20.15-160000.1.1
    • bind-debugsource-9.20.15-160000.1.1
    • bind-modules-mysql-9.20.15-160000.1.1
    • bind-modules-generic-debuginfo-9.20.15-160000.1.1
    • bind-utils-debuginfo-9.20.15-160000.1.1
    • bind-modules-ldap-debuginfo-9.20.15-160000.1.1
    • bind-modules-perl-9.20.15-160000.1.1
    • bind-debuginfo-9.20.15-160000.1.1
    • bind-modules-ldap-9.20.15-160000.1.1
    • bind-modules-sqlite3-debuginfo-9.20.15-160000.1.1
  • SUSE Linux Enterprise Server for SAP Applications 16.0 (noarch)
    • bind-doc-9.20.15-160000.1.1

References: