From ef4cc02326b866f0c3b6ea16b9a8244b065aa3ac Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Thu, 23 Jul 2026 11:00:37 +0000 Subject: [PATCH] Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) Backport fix for CVE-2026-11331 from upstream. The patch corrects RPZ name-too-long wildcard expansion in lib/ns/query.c by changing an `else if` to a standalone `if`, so that when DNS_R_NAMETOOLONG is returned the function properly returns the error result (YXDOMAIN response) instead of falling through to return a self-referential CNAME with the original address record. CVE: CVE-2026-11331 Upstream patches: - https://github.com/isc-projects/bind9/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4.patch Resolves: RHEL-213768 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- bind-9.18-CVE-2026-11331.patch | 27 +++++++++++++++++++++++++++ bind.spec | 7 ++++++- 2 files changed, 33 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-CVE-2026-11331.patch diff --git a/bind-9.18-CVE-2026-11331.patch b/bind-9.18-CVE-2026-11331.patch new file mode 100644 index 0000000..5d891e8 --- /dev/null +++ b/bind-9.18-CVE-2026-11331.patch @@ -0,0 +1,27 @@ +From 713060f54dd7da6aa18fdd57e2cf5f6603ddd6d0 Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Fri, 10 Apr 2026 10:26:14 +1000 +Subject: [PATCH] Properly handle rpz name to long wildcard expansion + +Previously a self referential CNAME and the original address +record were returned. We now return a YXDOMAIN response. + +(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3) +--- + lib/ns/query.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/ns/query.c b/lib/ns/query.c +index f7f0623713..609ef50739 100644 +--- a/lib/ns/query.c ++++ b/lib/ns/query.c +@@ -7575,7 +7575,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) { + qctx->fname, NULL); + if (result == DNS_R_NAMETOOLONG) { + client->message->rcode = dns_rcode_yxdomain; +- } else if (result != ISC_R_SUCCESS) { ++ } ++ if (result != ISC_R_SUCCESS) { + return result; + } + } else { diff --git a/bind.spec b/bind.spec index 965090e..a2bdcc1 100644 --- a/bind.spec +++ b/bind.spec @@ -80,7 +80,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.33 -Release: 20%{?dist} +Release: 21%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -172,6 +172,8 @@ Patch234: bind-9.18-CVE-2026-3039.patch Patch235: bind-9.18-CVE-2026-5946.patch # https://github.com/isc-projects/bind9/commit/48f5aa5fb3746d6194edcc57e8792a8b3cc3b454 Patch236: bind-9.18-CVE-2026-13204.patch +# https://github.com/isc-projects/bind9/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4 +Patch237: bind-9.18-CVE-2026-11331.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -973,6 +975,9 @@ fi; %endif %changelog +* Thu Jul 23 2026 RHEL Packaging Agent - 32:9.18.33-21 +- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) + * Thu Jul 23 2026 RHEL Packaging Agent - 32:9.18.33-20 - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204)