rpms/bind9.16
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix RPZ name-too-long wildcard expansion in bind9.16 (CVE-2026-11331)

Browse Source 
Backport upstream fix for CVE-2026-11331 to bind9.16. The patch
(from upstream commit ee2ac186bc) corrects the query_rpzcname()
function in lib/ns/query.c to properly handle RPZ name-too-long
wildcard expansion by returning YXDOMAIN instead of a
self-referential CNAME.

CVE: CVE-2026-11331
Upstream patches:
 - ee2ac186bc.patch
Resolves: RHEL-213764

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-23 11:17:06 +00:00 committed by Petr Menšík
parent 260a501b98
commit f61caccacf
2 changed files with 37 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
bind-9.16-CVE-2026-11331.patch Normal file
View File

@ -0,0 +1,29 @@
From c7b516d590dd832ad9e9d85665da1a6970d0ecb3 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 10 Apr 2026 10:26:14 +1000
Subject: [PATCH] Properly handle rpz name to long wildcard expansion
Previously a self referential CNAME and the original address
record were returned. We now return a YXDOMAIN response.
(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
---
lib/ns/query.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 4d6dd5d..bb0c629 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7064,8 +7064,9 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
qctx->fname, NULL);
if (result == DNS_R_NAMETOOLONG) {
client->message->rcode = dns_rcode_yxdomain;
- } else if (result != ISC_R_SUCCESS) {
- return (result);
+ }
+ if (result != ISC_R_SUCCESS) {
+ return result;
}
} else {
dns_name_copynf(cname, qctx->fname);

9
bind9.16.spec
View File

@ -62,7 +62,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
Name: bind9.16
License: MPLv2.0
Version: 9.16.23
Release: 0.22%{?dist}.7
Release: 0.22%{?dist}.8
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -189,6 +189,8 @@ Patch230: bind-9.16-CVE-2026-3039.patch
Patch231: bind-9.16-CVE-2026-5946.patch
# https://github.com/isc-projects/bind9/commit/1b90fbb4f9d3d923516ff7841171269b993cfd6f
Patch233: bind-9.16-CVE-2026-13204.patch
# https://github.com/isc-projects/bind9/commit/ee2ac186bc5f75f7f3f7049f1a21e9a2014cee59
Patch234: bind-9.16-CVE-2026-11331.patch
%{?systemd_ordering}
Requires: coreutils
@ -532,6 +534,7 @@ in HTML and PDF format.
%patch230 -p1 -b .CVE-2026-3039
%patch231 -p1 -b .CVE-2026-5946
%patch233 -p1 -b .CVE-2026-13204
%patch234 -p1 -b .CVE-2026-11331
%if %{with PKCS11}
%patch135 -p1 -b .config-pkcs11
@ -1274,6 +1277,10 @@ fi;
%endif
%changelog
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.8
- Fix RPZ name-too-long wildcard expansion (CVE-2026-11331)
- Resolves: RHEL-213478
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.16.23-0.22.7
- Fix CVE-2026-13204: ensure NSEC/NSEC3 has matching RRSIG
- Resolves: RHEL-213478