f61caccacf
Backport upstream fix for CVE-2026-11331 to bind9.16. The patch
(from upstream commit ee2ac186bc) corrects the query_rpzcname()
function in lib/ns/query.c to properly handle RPZ name-too-long
wildcard expansion by returning YXDOMAIN instead of a
self-referential CNAME.
CVE: CVE-2026-11331
Upstream patches:
- ee2ac186bc.patch
Resolves: RHEL-213764
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
30 lines
972 B
Diff
30 lines
972 B
Diff
From c7b516d590dd832ad9e9d85665da1a6970d0ecb3 Mon Sep 17 00:00:00 2001
|
|
From: Mark Andrews <marka@isc.org>
|
|
Date: Fri, 10 Apr 2026 10:26:14 +1000
|
|
Subject: [PATCH] Properly handle rpz name to long wildcard expansion
|
|
|
|
Previously a self referential CNAME and the original address
|
|
record were returned. We now return a YXDOMAIN response.
|
|
|
|
(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
|
|
---
|
|
lib/ns/query.c | 5 +++--
|
|
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/lib/ns/query.c b/lib/ns/query.c
|
|
index 4d6dd5d..bb0c629 100644
|
|
--- a/lib/ns/query.c
|
|
+++ b/lib/ns/query.c
|
|
@@ -7064,8 +7064,9 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
|
|
qctx->fname, NULL);
|
|
if (result == DNS_R_NAMETOOLONG) {
|
|
client->message->rcode = dns_rcode_yxdomain;
|
|
- } else if (result != ISC_R_SUCCESS) {
|
|
- return (result);
|
|
+ }
|
|
+ if (result != ISC_R_SUCCESS) {
|
|
+ return result;
|
|
}
|
|
} else {
|
|
dns_name_copynf(cname, qctx->fname);
|