A bind9 security update has been released for Debian GNU/Linux 9 LTS.

DLA 2807-1: bind9 security update

-------------------------------------------------------------------------
Debian LTS Advisory DLA-2807-1 debian-lts@lists.debian.org
  https://www.debian.org/lts/security/ Markus Koschany
November 01, 2021   https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : bind9
Version : 1:9.10.3.dfsg.P4-12.3+deb9u10
CVE ID : CVE-2018-5740 CVE-2021-25219
Debian Bug : 905743

CVE-2021-25219

Kishore Kumar Kothapalli discovered that the lame server cache in BIND,
a DNS server implementation, can be abused by an attacker to
significantly degrade resolver performance, resulting in denial of
service (large delays for responses for client queries and DNS timeouts
on client hosts).

CVE-2018-5740

"deny-answer-aliases" is a little-used feature intended to help recursive
server operators protect end users against DNS rebinding attacks, a
potential method of circumventing the security model used by client
browsers. However, a defect in this feature makes it easy, when the
feature is in use, to experience an assertion failure in name.c.

For Debian 9 stretch, these problems have been fixed in version
1:9.10.3.dfsg.P4-12.3+deb9u10.

We recommend that you upgrade your bind9 packages.

For the detailed security status of bind9 please refer to
its security tracker page at:
  https://security-tracker.debian.org/tracker/bind9

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at:   https://wiki.debian.org/LTS