rpms/bind9.18
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Fix RPZ wildcard expansion self-referential CNAME (CVE-2026-11331)

Browse Source 
Backport fix for CVE-2026-11331 from upstream commit dc328a199f.
The patch modifies query_rpzcname() in lib/ns/query.c to ensure
that when a wildcard expansion results in a name-too-long error,
the YXDOMAIN response code is set and the function properly
returns, rather than falling through to create a self-referential
CNAME.

CVE: CVE-2026-11331
Upstream patches:
 - dc328a199f.patch
Resolves: RHEL-213770

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
This commit is contained in:
RHEL Packaging Agent 2026-07-23 10:40:14 +00:00 committed by Petr Menšík
parent 73495a511e
commit 63924ba134
2 changed files with 33 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
bind-9.18-CVE-2026-11331.patch Normal file
View File

@ -0,0 +1,27 @@
From 86adbfb1a54ca16ba29c2dcf40eafd2fea8d40f2 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Fri, 10 Apr 2026 10:26:14 +1000
Subject: [PATCH] Properly handle rpz name to long wildcard expansion
Previously a self referential CNAME and the original address
record were returned. We now return a YXDOMAIN response.
(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3)
---
lib/ns/query.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/lib/ns/query.c b/lib/ns/query.c
index de1d65fcf1..b7a7c10df5 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -7529,7 +7529,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
qctx->fname, NULL);
if (result == DNS_R_NAMETOOLONG) {
client->message->rcode = dns_rcode_yxdomain;
- } else if (result != ISC_R_SUCCESS) {
+ }
+ if (result != ISC_R_SUCCESS) {
return (result);
}
} else {

7
bind9.18.spec
View File

@ -75,7 +75,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
# ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0
# ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0
Version: 9.18.29
Release: 18%{?dist}
Release: 19%{?dist}
Epoch: 32
Url: https://www.isc.org/downloads/bind/
#
@ -158,6 +158,8 @@ Patch234: bind-9.18-CVE-2026-3039.patch
Patch235: bind-9.18-CVE-2026-5946.patch
# https://github.com/isc-projects/bind9/commit/48f5aa5fb3746d6194edcc57e8792a8b3cc3b454
Patch236: bind-9.18-CVE-2026-13204.patch
# https://gitlab.isc.org/isc-projects/bind9/-/commit/dc328a199f96222e0c30cc20b7b795bfc2c9b2e4
Patch237: bind-9.18-CVE-2026-11331.patch
%{?systemd_ordering}
# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@ -1021,6 +1023,9 @@ fi;
%endif
%changelog
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.18.29-19
- Fix RPZ wildcard expansion self-referential CNAME (CVE-2026-11331)
* Thu Jul 23 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 32:9.18.29-18
- Fix assertion crash via unsigned NSEC/NSEC3 (CVE-2026-13204,
RHEL-213495)