From c88ee05b52af78b15868c4006cea651266580168 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 3 Aug 2026 15:56:43 +0200 Subject: [PATCH] fixup! Fix CVE-2026-11721: RRSIG label count validation for wildcard cache poisoning CVE: CVE-2026-11721 Resolves: RHEL-213411 --- bind-9.18-CVE-2026-11721-fix2.patch | 40 ++++++++ bind-9.18-CVE-2026-11721-test.patch | 144 ++++++++++++++++++++++++++++ bind-9.18-CVE-2026-11721.patch | 98 +++++++------------ bind.spec | 6 +- 4 files changed, 226 insertions(+), 62 deletions(-) create mode 100644 bind-9.18-CVE-2026-11721-fix2.patch create mode 100644 bind-9.18-CVE-2026-11721-test.patch diff --git a/bind-9.18-CVE-2026-11721-fix2.patch b/bind-9.18-CVE-2026-11721-fix2.patch new file mode 100644 index 0000000..0e2ae16 --- /dev/null +++ b/bind-9.18-CVE-2026-11721-fix2.patch @@ -0,0 +1,40 @@ +From 0532ea83b5e806e0d5b0b1fa85760c8d680ac173 Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Tue, 14 Apr 2026 15:14:06 +1000 +Subject: [PATCH] Don't sign out of zone records in dnssec-signzone + +dnssec-signzone was signing extraneous records that were not within +the namespace of the zone. This no longer occurs. + +(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd) + +Don't sign out of zone records in dnssec-signzone + +dnssec-signzone was signing extraneous records that were not within +the namespace of the zone. This no longer occurs. + +(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd) +(cherry picked from commit 1a4986e2533f87e80eb21da3f06708d335aff1e2) +--- + bin/dnssec/dnssec-signzone.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c +index b2c77d497a..d968f95d5e 100644 +--- a/bin/dnssec/dnssec-signzone.c ++++ b/bin/dnssec/dnssec-signzone.c +@@ -1643,6 +1643,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) { + dns_db_detachnode(gdb, &node); + goto next; + } ++ if (!dns_name_issubdomain(name, gorigin)) { ++ dumpnode(name, node); ++ dns_db_detachnode(gdb, &node); ++ goto next; ++ } + /* + * Sort the zone data from the glue and out-of-zone data. + * For NSEC zones nodes with zone data have NSEC records. +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-11721-test.patch b/bind-9.18-CVE-2026-11721-test.patch new file mode 100644 index 0000000..644a672 --- /dev/null +++ b/bind-9.18-CVE-2026-11721-test.patch @@ -0,0 +1,144 @@ +From 247b1944f3e658f9cf412dc986d3de39aa81e67f Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Tue, 14 Apr 2026 13:46:22 +1000 +Subject: [PATCH] Test RRSIG record parsing + +In particular test that labels and signer fields are consistent. + +(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2) +(cherry picked from commit 19e496ca260b6a756ae1378e8ebcbdb666b7d9ed) +--- + tests/dns/rdata_test.c | 110 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 110 insertions(+) + +diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c +index 921f3f0591..26f1dd901f 100644 +--- a/tests/dns/rdata_test.c ++++ b/tests/dns/rdata_test.c +@@ -2302,6 +2302,115 @@ ISC_RUN_TEST_IMPL(rkey) { + dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t)); + } + ++ISC_RUN_TEST_IMPL(rrsig) { ++ text_ok_t text_ok[] = { ++ TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 " ++ ". " ++ "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/" ++ "TEkOZApVG0F6E " ++ "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/" ++ "dIdheiig1VvU+9HXLi " ++ "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+" ++ "KJXOaxyHbqchYkDFy4PL6qftE " ++ "VaLkueRgjXgOsq/" ++ "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw " ++ "VjJsJTKw8neOTw2rQfLaigWu2LIWw+" ++ "IyVrLjZJdLqGkiLBGd1w4X3U12 " ++ "fFxoY3eqzNgBEtduoGKPZ/" ++ "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="), ++ /* labels too short for signer */ ++ TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 " ++ "54393 example. " ++ "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/" ++ "TEkOZApVG0F6E " ++ "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/" ++ "dIdheiig1VvU+9HXLi " ++ "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+" ++ "KJXOaxyHbqchYkDFy4PL6qftE " ++ "VaLkueRgjXgOsq/" ++ "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw " ++ "VjJsJTKw8neOTw2rQfLaigWu2LIWw+" ++ "IyVrLjZJdLqGkiLBGd1w4X3U12 " ++ "fFxoY3eqzNgBEtduoGKPZ/" ++ "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="), ++ /* ++ * Sentinel. ++ */ ++ TEXT_SENTINEL() ++ }; ++ wire_ok_t wire_ok[] = { ++ WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69, ++ 0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79, ++ 0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, ++ 0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, ++ 0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, ++ 0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, ++ 0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, ++ 0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, ++ 0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, ++ 0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, ++ 0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, ++ 0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, ++ 0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, ++ 0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, ++ 0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, ++ 0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, ++ 0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, ++ 0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, ++ 0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, ++ 0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, ++ 0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, ++ 0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, ++ 0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, ++ 0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, ++ 0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, ++ 0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, ++ 0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, ++ 0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, ++ 0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, ++ 0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, ++ 0x0c, 0x8c, 0xbc, 0x2a, 0x52), ++ /* labels too short for signer */ ++ WIRE_INVALID( ++ 0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69, ++ 0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79, ++ 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00, ++ 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e, ++ 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d, ++ 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17, ++ 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99, ++ 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29, ++ 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37, ++ 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43, ++ 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48, ++ 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd, ++ 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c, ++ 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9, ++ 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a, ++ 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58, ++ 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44, ++ 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e, ++ 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a, ++ 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1, ++ 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50, ++ 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c, ++ 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab, ++ 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16, ++ 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b, ++ 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17, ++ 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa, ++ 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f, ++ 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91, ++ 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78, ++ 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c, ++ 0x8c, 0xbc, 0x2a, 0x52), ++ ++ WIRE_SENTINEL() ++ }; ++ check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in, ++ dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t)); ++} ++ + ISC_RUN_TEST_IMPL(resinfo) { + text_ok_t text_ok[] = { + TEXT_VALID_CHANGED("qnamemin exterr=15,16,17 " +@@ -3152,6 +3261,7 @@ ISC_TEST_ENTRY(nsec3) + ISC_TEST_ENTRY(nxt) + ISC_TEST_ENTRY(rkey) + ISC_TEST_ENTRY(resinfo) ++ISC_TEST_ENTRY(rrsig) + ISC_TEST_ENTRY(sshfp) + ISC_TEST_ENTRY(wallet) + ISC_TEST_ENTRY(wks) +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-11721.patch b/bind-9.18-CVE-2026-11721.patch index 556ed08..5e524e6 100644 --- a/bind-9.18-CVE-2026-11721.patch +++ b/bind-9.18-CVE-2026-11721.patch @@ -1,7 +1,7 @@ -From fad5a6422c34fee9f159b81b76a3926bcb8d1487 Mon Sep 17 00:00:00 2001 +From 107fba6767a792bf9022dbfc8a75e3dc61c0d76d Mon Sep 17 00:00:00 2001 From: Mark Andrews Date: Tue, 14 Apr 2026 12:24:33 +1000 -Subject: [PATCH 1/2] Invalid signed wildcard records were being accepted +Subject: [PATCH] Invalid signed wildcard records were being accepted An RRSIG whose Labels field indicates fewer labels than its signer name requires was being accepted. When such a record covers a @@ -14,24 +14,33 @@ These records are now rejected, both when an RRSIG is parsed and when its signature is verified. (cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9) +(cherry picked from commit 15089066b15f826d7487c3d160b5872820f84b83) --- - lib/dns/dnssec.c | 39 ++++++++++++++++++++++++-------- - lib/dns/rdata/generic/rrsig_46.c | 33 +++++++++++++++++++++------ - 2 files changed, 55 insertions(+), 17 deletions(-) + lib/dns/dnssec.c | 43 +++++++++++++++++++++++--------- + lib/dns/rdata/generic/rrsig_46.c | 37 ++++++++++++++++++++------- + 2 files changed, 59 insertions(+), 21 deletions(-) diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c -index 662136db87..ea8feedb18 100644 +index 662136db87..86f03680e9 100644 --- a/lib/dns/dnssec.c +++ b/lib/dns/dnssec.c -@@ -137,7 +137,7 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata, +@@ -137,11 +137,11 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata, isc_buffer_t b; isc_region_t r; - INSIST(name != NULL); -+ INSIST(DNS_NAME_VALID(name)); - INSIST(rdata != NULL); - INSIST(mctx != NULL); - INSIST(key != NULL); +- INSIST(rdata != NULL); +- INSIST(mctx != NULL); +- INSIST(key != NULL); +- INSIST(*key == NULL); ++ REQUIRE(name != NULL); ++ REQUIRE(rdata != NULL); ++ REQUIRE(mctx != NULL); ++ REQUIRE(key != NULL); ++ REQUIRE(*key == NULL); + REQUIRE(rdata->type == dns_rdatatype_key || + rdata->type == dns_rdatatype_dnskey); + @@ -195,12 +195,14 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, isc_buffer_t *databuf = NULL; char data[256 + 8]; @@ -41,9 +50,8 @@ index 662136db87..ea8feedb18 100644 dns_fixedname_t fnewname; dns_fixedname_t fsigner; -- REQUIRE(name != NULL); + REQUIRE(name != NULL); - REQUIRE(dns_name_countlabels(name) <= 255); -+ REQUIRE(DNS_NAME_VALID(name)); + labels = dns_name_countlabels(name); + REQUIRE(labels <= 255 && labels > 0); REQUIRE(set != NULL); @@ -68,8 +76,7 @@ index 662136db87..ea8feedb18 100644 uint32_t flags; bool downcase = false; -- REQUIRE(name != NULL); -+ REQUIRE(DNS_NAME_VALID(name)); + REQUIRE(name != NULL); + labels = dns_name_countlabels(name); + REQUIRE(labels > 0); REQUIRE(set != NULL); @@ -128,7 +135,7 @@ index 662136db87..ea8feedb18 100644 RUNTIME_CHECK(dns_name_concatenate( dns_wildcardname, diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c -index 2cc315bdea..3230eca78b 100644 +index 2cc315bdea..53648f1bfa 100644 --- a/lib/dns/rdata/generic/rrsig_46.c +++ b/lib/dns/rdata/generic/rrsig_46.c @@ -23,12 +23,12 @@ @@ -136,7 +143,7 @@ index 2cc315bdea..3230eca78b 100644 fromtext_rrsig(ARGS_FROMTEXT) { isc_token_t token; - unsigned char c; -+ unsigned char c, labels; ++ unsigned char alg, labels; long i; dns_rdatatype_t covered; - char *e; @@ -147,6 +154,17 @@ index 2cc315bdea..3230eca78b 100644 isc_buffer_t buffer; uint32_t time_signed, time_expire; +@@ -61,8 +61,8 @@ fromtext_rrsig(ARGS_FROMTEXT) { + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + false)); +- RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion)); +- RETERR(mem_tobuffer(target, &c, 1)); ++ RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion)); ++ RETERR(mem_tobuffer(target, &alg, 1)); + + /* + * Labels. @@ -72,8 +72,8 @@ fromtext_rrsig(ARGS_FROMTEXT) { if (token.value.as_ulong > 0xffU) { RETTOK(ISC_R_RANGE); @@ -213,48 +231,6 @@ index 2cc315bdea..3230eca78b 100644 /* * Sig. */ +-- +2.55.0 -From 25fcb6ca775a2f3f047842fa89b185c582e19d30 Mon Sep 17 00:00:00 2001 -From: RHEL Packaging Agent -Date: Thu, 23 Jul 2026 12:17:07 +0000 -Subject: [PATCH 2/2] Replace DNS_NAME_VALID with ISC_MAGIC_VALID equivalent - for 9.18 compatibility - -DNS_NAME_VALID macro was introduced in BIND 9.20 and is not available in 9.18. -Replace with the equivalent ISC_MAGIC_VALID(name, DNS_NAME_MAGIC) expression -which is available in 9.18. ---- - lib/dns/dnssec.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c -index ea8feedb18..0b3b7fb2dc 100644 ---- a/lib/dns/dnssec.c -+++ b/lib/dns/dnssec.c -@@ -137,7 +137,7 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata, - isc_buffer_t b; - isc_region_t r; - -- INSIST(DNS_NAME_VALID(name)); -+ INSIST(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC)); - INSIST(rdata != NULL); - INSIST(mctx != NULL); - INSIST(key != NULL); -@@ -200,7 +200,7 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, - dns_fixedname_t fnewname; - dns_fixedname_t fsigner; - -- REQUIRE(DNS_NAME_VALID(name)); -+ REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC)); - labels = dns_name_countlabels(name); - REQUIRE(labels <= 255 && labels > 0); - REQUIRE(set != NULL); -@@ -391,7 +391,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, - uint32_t flags; - bool downcase = false; - -- REQUIRE(DNS_NAME_VALID(name)); -+ REQUIRE(ISC_MAGIC_VALID(name, DNS_NAME_MAGIC)); - labels = dns_name_countlabels(name); - REQUIRE(labels > 0); - REQUIRE(set != NULL); diff --git a/bind.spec b/bind.spec index d0b4af6..41c5ec1 100644 --- a/bind.spec +++ b/bind.spec @@ -174,7 +174,7 @@ Patch235: bind-9.18-CVE-2026-5946.patch Patch236: bind-9.18-CVE-2026-13204.patch # https://github.com/isc-projects/bind9/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4 Patch237: bind-9.18-CVE-2026-11331.patch -# https://github.com/isc-projects/bind9/commit/8a46533cbeab78c215ee035d73967a3a59925375 +# https://gitlab.isc.org/isc-projects/bind9/commit/15089066b15f826d7487c3d160b5872820f84b83 Patch238: bind-9.18-CVE-2026-11721.patch # https://github.com/isc-projects/bind9/commit/231b1ca3edfb26389e1af39181aa6b4413e87ec4 Patch239: bind-9.18-CVE-2026-11622.patch @@ -182,6 +182,10 @@ Patch239: bind-9.18-CVE-2026-11622.patch Patch240: bind-9.18-CVE-2026-13321.patch # https://github.com/isc-projects/bind9/commit/c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb Patch241: bind-9.18-CVE-2026-10723.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/19e496ca260b6a756ae1378e8ebcbdb666b7d9ed +Patch242: bind-9.18-CVE-2026-11721-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/1a4986e2533f87e80eb21da3f06708d335aff1e2 +Patch243: bind-9.18-CVE-2026-11721-fix2.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers