RHEA-2017:2540 - Product Enhancement Advisory

Topic

Updated bind packages that add one enhancement are now available for Red Hat Enterprise Linux 5 Extended Life Cycle Support.

Description

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

This update adds the following enhancement:

• This update adds a new Key Signing Key (KSK) to the list of trusted keys for the root zone. The list is maintained by the DNS Security Extension (DNSSEC) validating resolver. The new key has to be added to the list of trusted keys on new installations and existing installations before the former key is revoked on January 11, 2018. Existing installations can be updated to the new key using the RFC 5011 update mechanism while the former key is still valid. See the References section for more information. (BZ#1452647)

Users of bind are advised to upgrade to these updated packages, which add this enhancement.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 5 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 5 s390x

Fixes

CVEs

(none)

References

• https://www.icann.org/resources/pages/ksk-rollover