From 17fdaf5157bde17dfb89854baa41f577d4330a20 Mon Sep 17 00:00:00 2001 From: Andrew Lukoshko Date: Fri, 12 Apr 2024 12:30:04 +0000 Subject: [PATCH] use BIND macros when defining DNS names (CVE-2023-50387) --- ...-dyndb-ldap-11.9-bind-CVE-2023-50387.patch | 37 +++++++++++++++++++ SPECS/bind-dyndb-ldap.spec | 7 +++- 2 files changed, 43 insertions(+), 1 deletion(-) create mode 100644 SOURCES/bind-dyndb-ldap-11.9-bind-CVE-2023-50387.patch diff --git a/SOURCES/bind-dyndb-ldap-11.9-bind-CVE-2023-50387.patch b/SOURCES/bind-dyndb-ldap-11.9-bind-CVE-2023-50387.patch new file mode 100644 index 0000000..56f3a0f --- /dev/null +++ b/SOURCES/bind-dyndb-ldap-11.9-bind-CVE-2023-50387.patch @@ -0,0 +1,37 @@ +From dbbcc2f07ea6955c6b0b5a719f8058c54b1d750c Mon Sep 17 00:00:00 2001 +From: Alexander Bokovoy +Date: Feb 14 2024 12:31:22 +0000 +Subject: use BIND macros when defining DNS names + + +Fixes: https://pagure.io/bind-dyndb-ldap/issue/228 + +Signed-off-by: Alexander Bokovoy + +--- + +diff --git a/src/mldap.c b/src/mldap.c +index 92a330c..79efddb 100644 +--- a/src/mldap.c ++++ b/src/mldap.c +@@ -50,18 +50,7 @@ + static unsigned char uuid_rootname_ndata[] + = { 4, 'u', 'u', 'i', 'd', 4, 'l', 'd', 'a', 'p', 0 }; + static unsigned char uuid_rootname_offsets[] = { 0, 5, 10 }; +-static dns_name_t uuid_rootname = +-{ +- DNS_NAME_MAGIC, +- uuid_rootname_ndata, +- sizeof(uuid_rootname_ndata), +- sizeof(uuid_rootname_offsets), +- DNS_NAMEATTR_READONLY | DNS_NAMEATTR_ABSOLUTE, +- uuid_rootname_offsets, +- NULL, +- { (void *)-1, (void *)-1 }, +- { NULL, NULL } +-}; ++static dns_name_t uuid_rootname = DNS_NAME_INITABSOLUTE(uuid_rootname_ndata, uuid_rootname_offsets); + + struct mldapdb { + isc_mem_t *mctx; + diff --git a/SPECS/bind-dyndb-ldap.spec b/SPECS/bind-dyndb-ldap.spec index e004bba..1656e34 100644 --- a/SPECS/bind-dyndb-ldap.spec +++ b/SPECS/bind-dyndb-ldap.spec @@ -12,7 +12,7 @@ Name: bind-dyndb-ldap Version: 11.9 -Release: 8%{?dist} +Release: 8%{?dist}.3.alma.1 Summary: LDAP back-end plug-in for BIND License: GPLv2+ @@ -22,6 +22,8 @@ Source1: https://releases.pagure.org/%{name}/%{name}-%{VERSION}.tar.bz2.a Patch1: bind-dyndb-ldap-11.9-bind-9.16.17.patch Patch2: 0001-Modify-empty-zone-conflicts-under-exclusive-mode_rhbz#2129844.patch +# https://pagure.io/bind-dyndb-ldap/c/dbbcc2f07ea6955c6b0b5a719f8058c54b1d750c +Patch3: bind-dyndb-ldap-11.9-bind-CVE-2023-50387.patch BuildRequires: bind-devel >= %{bind_version}, bind-lite-devel >= %{bind_version} BuildRequires: krb5-devel @@ -117,6 +119,9 @@ sed -i.bak -e "$SEDSCRIPT" /etc/named.conf %changelog +* Fri Apr 12 2024 Andrew Lukoshko 11.9-8.3.alma.1 +- use BIND macros when defining DNS names (CVE-2023-50387) + * Wed Oct 19 2022 Rafael Jeffman - 11.9-8 - Modify empty zone conflicts under exclusive mode Resolves: rhbz#2129844, rhbz#2130614