bind9 bind 9.20.11

[Douglas R. Reno]

New point version, fixing a security vulnerability:

"- CVE-2025-40777: A possible assertion failure when 'stale-answer-client-timeout' is set to '0' ​https://kb.isc.org/docs/cve-2025-40777"

Upstream rates this as high.

[Douglas R. Reno]

Here are the rest of the release notes:

New Features

    Add support for the CO flag to dig.

    Add support for Compact Denial of Existence to dig. This includes showing the CO 
(Compact Answers OK) flag when displaying messages and adding an option to set the CO 
flag when making queries (dig +coflag). [GL #5319]

Bug Fixes

    Correct the default interface-interval from 60s to 60m.

    When the interface-interval parser was changed from a uint32 parser to a duration 
parser, the default value stayed at plain number 60 which now means 60 seconds instead 
of 60 minutes. The documentation also incorrectly states that the value is in minutes. 
That has been fixed. [GL #5246]

    Fix a purge-keys bug when using multiple views of a zone.

    Previously, when a DNSSEC key was purged by one zone view, other zone views would 
return an error about missing key files. This has been fixed. [GL #5315]

    Use IPv6 queries in delv +ns.

    delv +ns invokes the same code to perform name resolution as named, but it neglected 
to set up an IPv6 dispatch object first. Consequently, it was behaving more like named 
-4. It now sets up dispatch objects for both address families, and performs resolver 
queries to both IPv4 and IPv6 addresses, except when one of the address families has 
been suppressed by using delv -4 or delv -6. [GL #5352]

[Douglas R. Reno]

Fixed at 5bc103a3ac2f8a5662a18af73ccb9af8f951e08d

SA-12.3-074 issued