From 871d66ea84c1e1eff32b8df7869e81f12cd2db9d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 5 Aug 2026 12:42:07 +0200 Subject: [PATCH] Backport also upstream rpz system test change for CVE-2026-11331 CVE: CVE-2026-11331 Resolves: RHEL-213764 --- bind-9.16-CVE-2026-11331-test.patch | 75 +++++++++++++++++++++++++++++ bind9.16.spec | 5 ++ 2 files changed, 80 insertions(+) create mode 100644 bind-9.16-CVE-2026-11331-test.patch diff --git a/bind-9.16-CVE-2026-11331-test.patch b/bind-9.16-CVE-2026-11331-test.patch new file mode 100644 index 0000000..ea8499a --- /dev/null +++ b/bind-9.16-CVE-2026-11331-test.patch @@ -0,0 +1,75 @@ +From d4435021c0780353c66d860696a3ff40cfef5466 Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Fri, 10 Apr 2026 10:24:06 +1000 +Subject: [PATCH] Fix TTL extraction from A/AAAA record + +(cherry picked from commit 89c86e338db2492b92e6618c586f146c6928dc6d) +(cherry picked from commit e1c83d27984f10ff929bc54d6ed84b5152be96d5) + +Check rpz name too long wildcard CNAME expansion handling + +(cherry picked from commit 9345394e2097031b55b3ef34ceaadf5a7ebbeef2) +(cherry picked from commit 25b572a6d00f717d7992f154f28b43d2b2ffd0b3) +--- + bin/tests/system/rpz/ns2/tld2.db | 4 ++++ + bin/tests/system/rpz/ns4/tld4.db | 2 ++ + bin/tests/system/rpz/tests.sh | 5 ++++- + 3 files changed, 10 insertions(+), 1 deletion(-) + +diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db +index a16d196e39..b6ab030182 100644 +--- a/bin/tests/system/rpz/ns2/tld2.db ++++ b/bin/tests/system/rpz/ns2/tld2.db +@@ -1,5 +1,7 @@ + ; Copyright (C) Internet Systems Consortium, Inc. ("ISC") + ; ++; SPDX-License-Identifier: MPL-2.0 ++; + ; This Source Code Form is subject to the terms of the Mozilla Public + ; License, v. 2.0. If a copy of the MPL was not distributed with this + ; file, You can obtain one at http://mozilla.org/MPL/2.0/. +@@ -118,3 +120,5 @@ a6-2 A 192.168.6.2 + + a7-1 A 192.168.7.1 + TXT "a7-1 tld2 text" ++ ++*.wild A 192.168.9.1 +diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db +index a16481823d..a3ac815db4 100644 +--- a/bin/tests/system/rpz/ns4/tld4.db ++++ b/bin/tests/system/rpz/ns4/tld4.db +@@ -57,6 +57,8 @@ a3-6.tld2 A 56.56.56.56 + + a3-7.sub1.tld2 A 57.57.57.57 + ++*.wild.sub1.tld2 A 57.57.57.57 ++ + a3-8.tld2 A 58.58.58.58 + + a3-9.sub9.tld2 A 59.59.59.59 +diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh +index fe72456f25..0df394bcb2 100644 +--- a/bin/tests/system/rpz/tests.sh ++++ b/bin/tests/system/rpz/tests.sh +@@ -380,7 +380,7 @@ addr () { + digcmd $2 >$DIGNM + #ckalive "$2" "server crashed by 'dig $2'" || return 1 + ADDR_ESC=`echo "$ADDR" | sed -e 's/\./\\\\./g'` +- ADDR_TTL=`tr -d '\r' < $DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\) IN AA* ${ADDR_ESC}\$/\1/p"` ++ ADDR_TTL=$(tr -d '\r' <$DIGNM | sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\)[ ]IN[ ]AA*[ ]${ADDR_ESC}\$/\1/p") + if test -z "$ADDR_TTL"; then + setret "'dig $2' wrong; no address $ADDR record in $DIGNM" + return 1 +@@ -534,6 +534,9 @@ for mode in native dnsrps; do + ;; status: SERVFAIL, x + EOF + addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no ++ here aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.wild.sub1.tld2 <<'EOF' # 36 wildcard CNAME name to long ++ ;; status: YXDOMAIN, x ++EOF + end_group + ckstats $ns3 test1 ns3 22 + ckstats $ns5 test1 ns5 1 +-- +2.55.0 + diff --git a/bind9.16.spec b/bind9.16.spec index 2455d4e..c74211e 100644 --- a/bind9.16.spec +++ b/bind9.16.spec @@ -202,6 +202,9 @@ Patch237: bind-9.16-CVE-2026-13321.patch Patch238: bind-9.16-CVE-2026-10723.patch # https://gitlab.isc.org/isc-projects/bind9/commit/ebf391bdb8ea196dab43d0a1e1f639458cb15126 Patch239: bind-9.16-CVE-2026-11721-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/e1c83d27984f10ff929bc54d6ed84b5152be96d5 +# https://gitlab.isc.org/isc-projects/bind9/commit/25b572a6d00f717d7992f154f28b43d2b2ffd0b3 +Patch240: bind-9.16-CVE-2026-11331-test.patch %{?systemd_ordering} Requires: coreutils @@ -551,6 +554,7 @@ in HTML and PDF format. %patch237 -p1 -b .CVE-2026-13321 %patch238 -p1 -b .CVE-2026-10723 %patch239 -p1 -b .CVE-2026-11721-test +%patch240 -p1 -b .CVE-2026-11331-test %if %{with PKCS11} %patch135 -p1 -b .config-pkcs11 @@ -1312,6 +1316,7 @@ fi; * Thu Jul 23 2026 RHEL Packaging Agent - 32:9.16.23-0.22.8 - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) +- Add upstream rpz system test - Resolves: RHEL-213478 * Thu Jul 23 2026 RHEL Packaging Agent - 32:9.16.23-0.22.7