rpms/bind
7
0
Fork 1
Code Issues Pull Requests Releases Activity

Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)

Browse Source 
Backport fix for CVE-2026-11331 from upstream. The patch
corrects RPZ name-too-long wildcard expansion in
lib/ns/query.c by changing an `else if` to a standalone `if`,
so that when DNS_R_NAMETOOLONG is returned the function
properly returns the error result (YXDOMAIN response) instead
of falling through to return a self-referential CNAME with
the original address record.

CVE: CVE-2026-11331
Upstream patches:
 - dc328a199f.patch
Resolves: RHEL-213768

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-23 11:00:37 +00:00 committed by Petr Menšík
parent d8c000ca87
commit ef4cc02326
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
bind-9.18-CVE-2026-11331.patch Normal file
View File

@ -0,0 +1,27 @@
From 713060f54dd7da6aa18fdd57e2cf5f6603ddd6d0 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 10 Apr 2026 10:26:14 +1000
Subject: [PATCH] Properly handle rpz name to long wildcard expansion
Previously a self referential CNAME and the original address
record were returned. We now return a YXDOMAIN response.
(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
---
lib/ns/query.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/ns/query.c b/lib/ns/query.c
index f7f0623713..609ef50739 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7575,7 +7575,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
qctx->fname, NULL);
if (result == DNS_R_NAMETOOLONG) {
client->message->rcode = dns_rcode_yxdomain;
- } else if (result != ISC_R_SUCCESS) {
+ }
+ if (result != ISC_R_SUCCESS) {
return result;
}
} else {

7
bind.spec
View File

@ -80,7 +80,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
# Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
# Updating just bind will cause freeipa-dns-server package to be uninstallable.
Version: 9.18.33
Release: 20%{?dist}
Release: 21%{?dist}
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -172,6 +172,8 @@ Patch234: bind-9.18-CVE-2026-3039.patch
Patch235: bind-9.18-CVE-2026-5946.patch
# https://github.com/isc-projects/bind9/commit/48f5aa5fb3746d6194edcc57e8792a8b3cc3b454
Patch236: bind-9.18-CVE-2026-13204.patch
# https://github.com/isc-projects/bind9/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4
Patch237: bind-9.18-CVE-2026-11331.patch
%{?systemd_ordering}
# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@ -973,6 +975,9 @@ fi;
%endif
%changelog
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.18.33-21
- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.18.33-20
- Fix assertion failure on malformed NSEC/NSEC3 responses
(CVE-2026-13204)