From a33625773e8310439f3b3cb97939fcc41707fad5 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Mon, 27 Jul 2026 09:28:41 +0000 Subject: [PATCH] Fix CVE-2026-10723: validate NSEC3 signer matches owning zone Backport upstream fix for CVE-2026-10723 to bind-9.18.33. The patch adds NSEC3 signer validation in dns_dnssec_verify() to reject signatures whose signer field doesn't match the zone owning the NSEC3 record. This prevents a child zone from impersonating its parent zone and forging NXDOMAIN responses for sibling domains. The error message for DNS_R_INVALIDNSEC3 is also updated to reflect the broader scope of the check. CVE: CVE-2026-10723 Upstream patches: - https://github.com/isc-projects/bind9/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb.patch Resolves: RHEL-215707 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- bind-9.18-CVE-2026-10723.patch | 63 ++++++++++++++++++++++++++++++++++ bind.spec | 7 +++- 2 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-CVE-2026-10723.patch diff --git a/bind-9.18-CVE-2026-10723.patch b/bind-9.18-CVE-2026-10723.patch new file mode 100644 index 0000000..192fdca --- /dev/null +++ b/bind-9.18-CVE-2026-10723.patch @@ -0,0 +1,63 @@ +From 01bb483cbf162b79dde64f7005f2cbc76aaee96e Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Thu, 21 May 2026 14:41:55 -0700 +Subject: [PATCH] Check NSEC3 signer matches the owning zone + +When validating NSEC3 records, reject any signature whose signer field +does not match the zone owning the NSEC3. + +This ensures that a child zone cannot impersonate its parent and forge +NXDOMAIN responses for sibling domains. + +Fixes: isc-projects/bind9#5874 +(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b) +--- + lib/dns/dnssec.c | 19 +++++++++++++++++-- + lib/isc/result.c | 2 +- + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index 662136db87..d6259f939e 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -424,10 +424,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + } + + /* +- * NS, SOA and DNSSKEY records are signed by their owner. +- * DS records are signed by the parent. ++ * NS, SOA and DNSSKEY records are signed by their owners. ++ * NSEC3 records are signed by the apex, exactly one level up ++ * from their owner names. ++ * DS records are signed by the parent zone. + */ + switch (set->type) { ++ case dns_rdatatype_nsec3: { ++ dns_name_t apex = DNS_NAME_INITEMPTY; ++ labels = dns_name_countlabels(name); ++ if (labels <= 1) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_INVALIDNSEC3; ++ } ++ dns_name_split(name, labels - 1, NULL, &apex); ++ if (!dns_name_equal(&apex, &sig.signer)) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_SIGINVALID; ++ } ++ } break; + case dns_rdatatype_ns: + case dns_rdatatype_soa: + case dns_rdatatype_dnskey: +diff --git a/lib/isc/result.c b/lib/isc/result.c +index 493c1a5309..5e242ac285 100644 +--- a/lib/isc/result.c ++++ b/lib/isc/result.c +@@ -198,7 +198,7 @@ static const char *description[ISC_R_NRESULTS] = { + [DNS_R_COVERINGNSEC] = "covering NSEC record returned", + [DNS_R_MXISADDRESS] = "MX is an address", + [DNS_R_DUPLICATE] = "duplicate query", +- [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)", ++ [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name", + [DNS_R_NOTPRIMARY] = "not primary", + [DNS_R_BROKENCHAIN] = "broken trust chain", + [DNS_R_EXPIRED] = "expired", diff --git a/bind.spec b/bind.spec index 4f74e96..d0b4af6 100644 --- a/bind.spec +++ b/bind.spec @@ -80,7 +80,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.33 -Release: 24%{?dist} +Release: 25%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -180,6 +180,8 @@ Patch238: bind-9.18-CVE-2026-11721.patch Patch239: bind-9.18-CVE-2026-11622.patch # https://github.com/isc-projects/bind9/commit/36f3d50f9c8ebc8d25ee033e707ca502e20b083f Patch240: bind-9.18-CVE-2026-13321.patch +# https://github.com/isc-projects/bind9/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb +Patch241: bind-9.18-CVE-2026-10723.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -981,6 +983,9 @@ fi; %endif %changelog +* Mon Jul 27 2026 RHEL Packaging Agent - 32:9.18.33-25 +- Validate NSEC3 signer matches owning zone (CVE-2026-10723) + * Fri Jul 24 2026 RHEL Packaging Agent - 32:9.18.33-24 - Reject out-of-zone NSEC next owner names (CVE-2026-13321)