From 06ce50e3cf910ac41fcb7b7f62e4684aa542639c Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 17 Aug 2026 18:48:27 -0400 Subject: [PATCH] import UBI unbound-1.24.2-7.el10_2.4 --- unbound-1.25.2-CVE-2026-44690-test.patch | 393 +++++++++++++++++++++++ unbound-1.25.2-CVE-2026-44690.patch | 155 +++++++++ unbound-1.25.2-CVE-2026-55973-test.patch | 240 ++++++++++++++ unbound-1.25.2-CVE-2026-55973.patch | 29 ++ unbound.spec | 19 +- 5 files changed, 835 insertions(+), 1 deletion(-) create mode 100644 unbound-1.25.2-CVE-2026-44690-test.patch create mode 100644 unbound-1.25.2-CVE-2026-44690.patch create mode 100644 unbound-1.25.2-CVE-2026-55973-test.patch create mode 100644 unbound-1.25.2-CVE-2026-55973.patch diff --git a/unbound-1.25.2-CVE-2026-44690-test.patch b/unbound-1.25.2-CVE-2026-44690-test.patch new file mode 100644 index 0000000..823136e --- /dev/null +++ b/unbound-1.25.2-CVE-2026-44690-test.patch @@ -0,0 +1,393 @@ +From 7bc5ccf3f5edf4d169bb0d2d3e55accc7449dc9f Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 22 Jul 2026 11:56:08 +0200 +Subject: [PATCH] - Unit test for CVE-2026-44690. + +--- + testdata/rrsig_agr_wild.rpl | 374 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 374 insertions(+) + create mode 100644 testdata/rrsig_agr_wild.rpl + +diff --git a/unbound-1.24.2/testdata/rrsig_agr_wild.rpl b/unbound-1.24.2/testdata/rrsig_agr_wild.rpl +new file mode 100644 +index 0000000..7281aa7 +--- /dev/null ++++ b/unbound-1.24.2/testdata/rrsig_agr_wild.rpl +@@ -0,0 +1,374 @@ ++; config options ++; The island of trust is at com. ++server: ++ trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b" ++ val-override-date: "20201020135527" ++ target-fetch-policy: "0 0 0 0 0" ++ qname-minimisation: "no" ++ fake-sha1: yes ++ trust-anchor-signaling: no ++ minimal-responses: no ++ iter-scrub-promiscuous: no ++ aggressive-nsec: yes ++ local-zone: test. nodefault ++ log-servfail: yes ++ ++stub-zone: ++ name: "." ++ stub-addr: 193.0.14.129 # K.ROOT-SERVERS.NET. ++CONFIG_END ++ ++SCENARIO_BEGIN Test with RRSIG labels for wildcard with aggressive cache. ++ ++; K.ROOT-SERVERS.NET. ++RANGE_BEGIN 0 100 ++ ADDRESS 193.0.14.129 ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR NOERROR ++SECTION QUESTION ++. IN NS ++SECTION ANSWER ++. IN NS K.ROOT-SERVERS.NET. ++SECTION ADDITIONAL ++K.ROOT-SERVERS.NET. IN A 193.0.14.129 ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode subdomain ++ADJUST copy_id copy_query ++REPLY QR NOERROR ++SECTION QUESTION ++test. IN NS ++SECTION AUTHORITY ++test. IN NS ns.test. ++SECTION ADDITIONAL ++ns.test. IN A 1.2.3.5 ++ENTRY_END ++RANGE_END ++ ++; ns.test ++RANGE_BEGIN 0 100 ++ ADDRESS 1.2.3.5 ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++test. IN NS ++SECTION ANSWER ++test. IN NS ns.test ++test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s= ++SECTION ADDITIONAL ++ns.test. IN A 1.2.3.5 ++ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.test. IN A ++SECTION ANSWER ++ns.test. IN A 1.2.3.5 ++ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.test. IN AAAA ++SECTION AUTHORITY ++test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 ++test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= ++ns.test. 3600 IN NSEC nz.test. A RRSIG ++ns.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++test. IN DNSKEY ++SECTION ANSWER ++test. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} ++test. 3600 IN RRSIG DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc= ++SECTION ADDITIONAL ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qname qtype ++ADJUST copy_id ++REPLY QR AA NXDOMAIN ++SECTION QUESTION ++domain1.test. IN A ++SECTION ANSWER ++SECTION AUTHORITY ++test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 ++test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= ++test. 3600 IN NSEC abc.test. NS SOA DNSKEY RRSIG NSEC ++test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. SHU0veyxtCpPvwdJxn2xCEq9xXJZLIvAlYYy7/dBMSjo6ugBPSxs1+8hUZFxks+YQoPLR5nTU0C0yuhZ9dfg/2VGkCYLsDLYnh1lJj6uQ2VgwfhbwSJC0E9hwYvD7yl6LcmpySbGiyI0cCbK/wWHE8wVw4VBcbuv01f3Cj6F+mo= ++cee.test. 3600 IN NSEC erts.test. RRSIG DS ++cee.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. kIveXrsXAeb7fsc3YNZ6UyJeCGxENpeUAl3mUCW2py+0vXfLjmDNs4FG5cwkLSIrni1z8k4939Bt+/3i+ABE84Utb77LpF29+dIay0L5V9c+avY2rJH8F1JU0kidtFQAccZqXuHtGSHHAi35w09UqghK+hNKfv+7qRUICX5ByCA= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qname qtype ++ADJUST copy_id ++REPLY QR AA NXDOMAIN ++SECTION QUESTION ++domain2.test. IN DS ++SECTION ANSWER ++SECTION AUTHORITY ++test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 ++test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= ++test. 3600 IN NSEC abc.test. NS SOA DNSKEY RRSIG NSEC ++test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. SHU0veyxtCpPvwdJxn2xCEq9xXJZLIvAlYYy7/dBMSjo6ugBPSxs1+8hUZFxks+YQoPLR5nTU0C0yuhZ9dfg/2VGkCYLsDLYnh1lJj6uQ2VgwfhbwSJC0E9hwYvD7yl6LcmpySbGiyI0cCbK/wWHE8wVw4VBcbuv01f3Cj6F+mo= ++cee.test. 3600 IN NSEC erts.test. RRSIG DS ++cee.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. kIveXrsXAeb7fsc3YNZ6UyJeCGxENpeUAl3mUCW2py+0vXfLjmDNs4FG5cwkLSIrni1z8k4939Bt+/3i+ABE84Utb77LpF29+dIay0L5V9c+avY2rJH8F1JU0kidtFQAccZqXuHtGSHHAi35w09UqghK+hNKfv+7qRUICX5ByCA= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qname qtype ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++example.test. IN DS ++SECTION ANSWER ++example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 ++example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode subdomain ++ADJUST copy_id copy_query ++REPLY QR NOERROR ++SECTION QUESTION ++example.test. IN NS ++SECTION AUTHORITY ++example.test. IN NS ns.example.test. ++example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 ++example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= ++SECTION ADDITIONAL ++ns.example.test. IN A 1.2.3.4 ++ENTRY_END ++ ++RANGE_END ++ ++; ns.example.test. ++RANGE_BEGIN 0 100 ++ ADDRESS 1.2.3.4 ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR NOERROR ++SECTION QUESTION ++example.test. IN NS ++SECTION ANSWER ++example.test. IN NS ns.example.test. ++example.test. 3600 IN RRSIG NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4= ++SECTION ADDITIONAL ++ns.example.test. IN A 1.2.3.4 ++ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.example.test. IN A ++SECTION ANSWER ++ns.example.test. IN A 1.2.3.4 ++ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.example.test. IN AAAA ++SECTION AUTHORITY ++example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 ++example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= ++ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG ++example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 ++ENTRY_END ++ ++; response to DNSKEY priming query ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR NOERROR ++SECTION QUESTION ++example.test. IN DNSKEY ++SECTION ANSWER ++example.test. 3600 IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} ++example.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g= ++ENTRY_END ++ ++; response to query of interest ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++wild.example.test. IN A ++SECTION ANSWER ++wild.example.test. IN A 10.20.30.40 ++; normal RRSIG: ++;wild.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. RzIsliJeEcLIHQGJqr5U2tfgxjzyxvwpqWYMdF2qOmb5a5erx3AFwRLbHhl7383Kdpdi+KxVKIWmkG6YCta0sWE42UeDXAVtZnFK/VeADRWpzWljQaTdIG8eN6FdB/X3gSPXnxMhsd9OoAWHPJYrwXtoFbciH6Hy0gl4Cosc+7Q= ++; with labelcount lower, 2 lower. ++; like it is : *.test. IN A 10.20.30.40 ++wild.example.test. 3600 IN RRSIG A 8 1 3600 20201116135527 20201019135527 55567 example.test. XR1dPkaZmhIXoKRBmVLiDdIROYxlVNuII0kD/Nh/L3QteSvjwdfDBbVvwWGc+y011is0eFZBlFHWxmhw8BXytktlcJ3rZ1GPbcixkX7XPIIZER7jvZiFnKDS2Fwgh2wgpAXdo8KrmMgeUGPjP9scbzbBxLfSV/ja93PTuTSi6VA= ++SECTION AUTHORITY ++un.example.test. 3600 IN NSEC xy.example.test. A RRSIG ++un.example.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. rP0p0viq8A3y/RSth9BNkDVAufPRVp8uohX+Wp1lby4naxlOjZCONz3aeLz8c0XgrIUtdU4t2sZZz9gF9jfr/QnAr5JDMDAIpMXKYGx/3dk5mSP/OBRX9sNVuBdr9YuyYy5N9K97aKTSQTRNU8FdTVYx9yjImVlwA8KI+SkztJ4= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++wild2.example.test. IN DS ++SECTION ANSWER ++wild2.example.test. IN DS 12345 250 2 00000000 ++; normal RRSIG ++; wild2.example.test. 3600 IN RRSIG DS 8 3 3600 20201116135527 20201019135527 55567 example.test. GdSaD9J3c2QwsAPRbzY7lbuqguaBNEu/19jnZIrdMx4nmRRaMOS1MqMGZyOJdYvupVA0zg32bhCbmZdHSQLwzybjIgixGeiPC9MnfHdSqZKG7QG/AlUR2A/Mhmedp7RngROgIf6c7de88zsX+60xSfvBgNtg55YmODHqOICvTLs= ++; with labelcount lower, 2 lower. ++; for *.test. IN DS 12345 250 2 00000000 ++wild2.example.test. 3600 IN RRSIG DS 8 1 3600 20201116135527 20201019135527 55567 example.test. qZQ/bfTCVuGISm6Pkq6OYDnyZMx8/uQQE3vq402UVWyy7ZrDBVI/CAErEIqz7Xl4cGgFUoezL2LCBIS7BMERCbQ0cVm3YTpnSzCgiDNJsu9W778SLOTcWlqJaiJn9EieFGkiFo2k3c1iuW++yufdhQmuXGk+DdLzE87tgvIkQm0= ++SECTION AUTHORITY ++un.example.test. 3600 IN NSEC xy.example.test. A RRSIG ++un.example.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. rP0p0viq8A3y/RSth9BNkDVAufPRVp8uohX+Wp1lby4naxlOjZCONz3aeLz8c0XgrIUtdU4t2sZZz9gF9jfr/QnAr5JDMDAIpMXKYGx/3dk5mSP/OBRX9sNVuBdr9YuyYy5N9K97aKTSQTRNU8FdTVYx9yjImVlwA8KI+SkztJ4= ++ENTRY_END ++RANGE_END ++ ++STEP 1 QUERY ++ENTRY_BEGIN ++REPLY RD DO ++SECTION QUESTION ++domain1.test. IN A ++ENTRY_END ++ ++; Picks up NSECs for aggressive negative cache. ++STEP 10 CHECK_ANSWER ++ENTRY_BEGIN ++MATCH all ++REPLY QR RD RA AD DO NXDOMAIN ++SECTION QUESTION ++domain1.test. IN A ++SECTION AUTHORITY ++test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 ++test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= ++test. 3600 IN NSEC abc.test. NS SOA DNSKEY RRSIG NSEC ++test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. SHU0veyxtCpPvwdJxn2xCEq9xXJZLIvAlYYy7/dBMSjo6ugBPSxs1+8hUZFxks+YQoPLR5nTU0C0yuhZ9dfg/2VGkCYLsDLYnh1lJj6uQ2VgwfhbwSJC0E9hwYvD7yl6LcmpySbGiyI0cCbK/wWHE8wVw4VBcbuv01f3Cj6F+mo= ++cee.test. 3600 IN NSEC erts.test. RRSIG DS ++cee.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. kIveXrsXAeb7fsc3YNZ6UyJeCGxENpeUAl3mUCW2py+0vXfLjmDNs4FG5cwkLSIrni1z8k4939Bt+/3i+ABE84Utb77LpF29+dIay0L5V9c+avY2rJH8F1JU0kidtFQAccZqXuHtGSHHAi35w09UqghK+hNKfv+7qRUICX5ByCA= ++ENTRY_END ++ ++STEP 20 QUERY ++ENTRY_BEGIN ++REPLY RD DO ++SECTION QUESTION ++wild.example.test. IN A ++ENTRY_END ++ ++; query for the wildcard record. ++STEP 30 CHECK_ANSWER ++ENTRY_BEGIN ++MATCH all ++REPLY QR RD RA DO SERVFAIL ++SECTION QUESTION ++wild.example.test. IN A ++ENTRY_END ++;REPLY QR RD RA AD DO NXDOMAIN ++;SECTION QUESTION ++;domain1.test. IN A ++;SECTION ANSWER ++;wild.example.test. IN A 10.20.30.40 ++;wild.example.test. 3600 IN RRSIG A 8 1 3600 20201116135527 20201019135527 55567 example.test. XR1dPkaZmhIXoKRBmVLiDdIROYxlVNuII0kD/Nh/L3QteSvjwdfDBbVvwWGc+y011is0eFZBlFHWxmhw8BXytktlcJ3rZ1GPbcixkX7XPIIZER7jvZiFnKDS2Fwgh2wgpAXdo8KrmMgeUGPjP9scbzbBxLfSV/ja93PTuTSi6VA= ++;SECTION AUTHORITY ++;un.example.test. 3600 IN NSEC xy.example.test. A RRSIG ++;un.example.test. 3600 IN RRSIG NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. rP0p0viq8A3y/RSth9BNkDVAufPRVp8uohX+Wp1lby4naxlOjZCONz3aeLz8c0XgrIUtdU4t2sZZz9gF9jfr/QnAr5JDMDAIpMXKYGx/3dk5mSP/OBRX9sNVuBdr9YuyYy5N9K97aKTSQTRNU8FdTVYx9yjImVlwA8KI+SkztJ4= ++;ENTRY_END ++ ++;STEP 40 QUERY ++;ENTRY_BEGIN ++;REPLY RD DO ++;SECTION QUESTION ++;domain2.test. IN A ++;ENTRY_END ++; ++;; aggressive cache synthesis, the '*.test' from the wildcard lookup. ++;STEP 50 CHECK_ANSWER ++;ENTRY_BEGIN ++;MATCH all ++;REPLY QR RD RA DO SERVFAIL ++;SECTION QUESTION ++;domain2.test. IN A ++;SECTION ANSWER ++;ENTRY_END ++ ++STEP 60 QUERY ++ENTRY_BEGIN ++REPLY RD DO ++SECTION QUESTION ++wild2.example.test. IN DS ++ENTRY_END ++ ++; wild2 is for *.test DS ++STEP 70 CHECK_ANSWER ++ENTRY_BEGIN ++MATCH all ++REPLY QR RD RA DO SERVFAIL ++SECTION QUESTION ++wild2.example.test. IN DS ++SECTION ANSWER ++ENTRY_END ++ ++STEP 80 QUERY ++ENTRY_BEGIN ++REPLY RD DO ++SECTION QUESTION ++domain3.test. IN A ++ENTRY_END ++ ++; aggressive cache synthesis, the '*.test' from the wildcard lookup. ++; with '*.test' DS record. ++STEP 90 CHECK_ANSWER ++ENTRY_BEGIN ++MATCH all ++ ++; The bad answer ++;REPLY QR RD RA DO NOERROR ++;SECTION QUESTION ++;domain3.test. IN A ++;SECTION ANSWER ++;domain3.test. 0 IN A 10.20.30.40 ++;domain3.test. 0 IN RRSIG A 8 1 3600 20201116135527 20201019135527 55567 example.test. XR1dPkaZmhIXoKRBmVLiDdIROYxlVNuII0kD/Nh/L3QteSvjwdfDBbVvwWGc+y011is0eFZBlFHWxmhw8BXytktlcJ3rZ1GPbcixkX7XPIIZER7jvZiFnKDS2Fwgh2wgpAXdo8KrmMgeUGPjP9scbzbBxLfSV/ja93PTuTSi6VA= ;{id = 55567} ++;SECTION AUTHORITY ++;cee.test. 0 IN NSEC erts.test. DS RRSIG ++;cee.test. 0 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. kIveXrsXAeb7fsc3YNZ6UyJeCGxENpeUAl3mUCW2py+0vXfLjmDNs4FG5cwkLSIrni1z8k4939Bt+/3i+ABE84Utb77LpF29+dIay0L5V9c+avY2rJH8F1JU0kidtFQAccZqXuHtGSHHAi35w09UqghK+hNKfv+7qRUICX5ByCA= ;{id = 1444} ++ ++; The correct answer ++REPLY QR RD RA AD DO NXDOMAIN ++SECTION QUESTION ++domain3.test. IN A ++SECTION AUTHORITY ++test. 3600 IN NSEC abc.test. NS SOA DNSKEY RRSIG NSEC ++test. 3600 IN RRSIG NSEC 8 1 3600 20201116135527 20201019135527 1444 test. SHU0veyxtCpPvwdJxn2xCEq9xXJZLIvAlYYy7/dBMSjo6ugBPSxs1+8hUZFxks+YQoPLR5nTU0C0yuhZ9dfg/2VGkCYLsDLYnh1lJj6uQ2VgwfhbwSJC0E9hwYvD7yl6LcmpySbGiyI0cCbK/wWHE8wVw4VBcbuv01f3Cj6F+mo= ++cee.test. 3600 IN NSEC erts.test. RRSIG DS ++cee.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. kIveXrsXAeb7fsc3YNZ6UyJeCGxENpeUAl3mUCW2py+0vXfLjmDNs4FG5cwkLSIrni1z8k4939Bt+/3i+ABE84Utb77LpF29+dIay0L5V9c+avY2rJH8F1JU0kidtFQAccZqXuHtGSHHAi35w09UqghK+hNKfv+7qRUICX5ByCA= ++test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 ++test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= ++ENTRY_END ++ ++SCENARIO_END +-- +2.55.0 + diff --git a/unbound-1.25.2-CVE-2026-44690.patch b/unbound-1.25.2-CVE-2026-44690.patch new file mode 100644 index 0000000..26462b7 --- /dev/null +++ b/unbound-1.25.2-CVE-2026-44690.patch @@ -0,0 +1,155 @@ +From e1333c142bc6f52cadc3fd0e81a36757202e2e02 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 22 Jul 2026 10:12:38 +0200 +Subject: [PATCH] - Fix CVE-2026-44690, Cross-zone wildcard cache poisoning via + RRSIG.labels manipulation. Thanks to Qifan Zhang, Palo Alto Networks, for + the report. + +--- + services/cache/rrset.c | 32 ++++++++++++++++++++++++++++++++ + validator/val_sigcrypt.c | 7 +++++++ + validator/val_utils.c | 2 +- + validator/val_utils.h | 4 ++++ + validator/validator.c | 15 +++++++++++++-- + 5 files changed, 57 insertions(+), 3 deletions(-) + +diff --git a/unbound-1.24.2/services/cache/rrset.c b/unbound-1.24.2/services/cache/rrset.c +index 81f4e282..46dc0f27 100644 +--- a/unbound-1.24.2/services/cache/rrset.c ++++ b/unbound-1.24.2/services/cache/rrset.c +@@ -50,6 +50,7 @@ + #include "util/regional.h" + #include "util/alloc.h" + #include "util/net_help.h" ++#include "validator/val_utils.h" + + void + rrset_markdel(void* key) +@@ -255,12 +256,43 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref, + return 0; + } + ++/** See if the name is a within signer authority */ ++static int ++dname_subdomain_rrsig_signers(uint8_t* dname, ++ struct ub_packed_rrset_key* rrset) ++{ ++ struct packed_rrset_data* d = (struct packed_rrset_data*) ++ rrset->entry.data; ++ size_t i; ++ if(!d || !d->rrsig_count) ++ return 0; ++ for(i=0; irrsig_count; i++) { ++ uint8_t* sname = NULL; ++ size_t slen = 0; ++ rrsig_get_signer(d->rr_data[d->count+i], d->rr_len[d->count+i], ++ &sname, &slen); ++ if(!sname || !slen) ++ return 0; /* malformed */ ++ if(!dname_subdomain_c(dname, sname)) ++ return 0; /* not a subdomain */ ++ } ++ return 1; ++} ++ + void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache, + struct ub_packed_rrset_key* rrset, uint8_t* ce, size_t ce_len, + struct alloc_cache* alloc, time_t timenow) + { + struct rrset_ref ref; + uint8_t wc_dname[LDNS_MAX_DOMAINLEN+3]; ++ ++ /* See if the RRSIG signer name allows this wildcard, ++ * the new rrset should fall within the zone of the RRSIG signer(s). */ ++ if(!dname_subdomain_rrsig_signers(ce, rrset)) { ++ verbose(VERB_ALGO, "wildcard canonical parent outside signer authority"); ++ return; ++ } ++ + rrset = packed_rrset_copy_alloc(rrset, alloc, timenow); + if(!rrset) { + log_err("malloc failure in rrset_cache_update_wildcard"); +diff --git a/unbound-1.24.2/validator/val_sigcrypt.c b/unbound-1.24.2/validator/val_sigcrypt.c +index 86de6fb8..771be3bc 100644 +--- a/unbound-1.24.2/validator/val_sigcrypt.c ++++ b/unbound-1.24.2/validator/val_sigcrypt.c +@@ -1654,6 +1654,13 @@ dnskey_verify_rrset_sig(struct regional* region, sldns_buffer* buf, + *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; + return sec_status_bogus; + } ++ if((int)sig[2+3] < dname_signame_label_count(signer)) { ++ verbose(VERB_QUERY, "verify: RRSIG label count too low for signer"); ++ *reason = "signature labelcount lower than signature signer"; ++ if(reason_bogus) ++ *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; ++ return sec_status_bogus; ++ } + + /* original ttl, always ok */ + +diff --git a/unbound-1.24.2/validator/val_utils.c b/unbound-1.24.2/validator/val_utils.c +index 4495695a..fd00880c 100644 +--- a/unbound-1.24.2/validator/val_utils.c ++++ b/unbound-1.24.2/validator/val_utils.c +@@ -157,7 +157,7 @@ val_classify_response(uint16_t query_flags, struct query_info* origqinf, + } + + /** Get signer name from RRSIG */ +-static void ++void + rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, size_t* slen) + { + /* RRSIG rdata is not allowed to be compressed, it is stored +diff --git a/unbound-1.24.2/validator/val_utils.h b/unbound-1.24.2/validator/val_utils.h +index 4fe38c1b..029c85be 100644 +--- a/unbound-1.24.2/validator/val_utils.h ++++ b/unbound-1.24.2/validator/val_utils.h +@@ -427,4 +427,8 @@ int val_favorite_ds_algo(struct ub_packed_rrset_key* ds_rrset); + struct dns_msg* val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, + uint16_t c, struct regional* region, uint8_t* topname); + ++/** Get signer name from RRSIG, sname is NULL if malformed. */ ++void rrsig_get_signer(uint8_t* data, size_t len, uint8_t** sname, ++ size_t* slen); ++ + #endif /* VALIDATOR_VAL_UTILS_H */ +diff --git a/unbound-1.24.2/validator/validator.c b/unbound-1.24.2/validator/validator.c +index 5817fc80..96d75d0f 100644 +--- a/unbound-1.24.2/validator/validator.c ++++ b/unbound-1.24.2/validator/validator.c +@@ -1012,6 +1012,10 @@ validate_positive_response(struct module_env* env, struct val_env* ve, + uint8_t* wc = NULL; + size_t wl; + int wc_cached = 0; ++ int wc_to_cache = 0; ++ uint8_t* cache_wc = NULL; ++ size_t cache_wl = 0; ++ struct ub_packed_rrset_key* cache_s = NULL; + int wc_NSEC_ok = 0; + int nsec3s_seen = 0; + size_t i; +@@ -1034,8 +1038,11 @@ validate_positive_response(struct module_env* env, struct val_env* ve, + return; + } + if(wc && !wc_cached && env->cfg->aggressive_nsec) { +- rrset_cache_update_wildcard(env->rrset_cache, s, wc, wl, +- env->alloc, *env->now); ++ /* Postpone cache adjust until proof has succeeded. */ ++ wc_to_cache = 1; ++ cache_wc = wc; ++ cache_wl = wl; ++ cache_s = s; + wc_cached = 1; + } + +@@ -1097,6 +1104,10 @@ validate_positive_response(struct module_env* env, struct val_env* ve, + update_reason_bogus(chase_reply, LDNS_EDE_DNSSEC_BOGUS); + return; + } ++ if(wc_to_cache) { ++ rrset_cache_update_wildcard(env->rrset_cache, cache_s, ++ cache_wc, cache_wl, env->alloc, *env->now); ++ } + + verbose(VERB_ALGO, "Successfully validated positive response"); + chase_reply->security = sec_status_secure; diff --git a/unbound-1.25.2-CVE-2026-55973-test.patch b/unbound-1.25.2-CVE-2026-55973-test.patch new file mode 100644 index 0000000..d82addc --- /dev/null +++ b/unbound-1.25.2-CVE-2026-55973-test.patch @@ -0,0 +1,240 @@ +From 0f5cbd5f6c92777a068bacd98221b2ebf5265155 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 22 Jul 2026 12:04:35 +0200 +Subject: [PATCH] - Unit test for CVE-2026-55973. + +--- + testdata/errreport_agent_domain_len.rpl | 221 ++++++++++++++++++++++++ + 1 file changed, 221 insertions(+) + create mode 100644 testdata/errreport_agent_domain_len.rpl + +diff --git a/unbound-1.24.2/testdata/errreport_agent_domain_len.rpl b/unbound-1.24.2/testdata/errreport_agent_domain_len.rpl +new file mode 100644 +index 0000000..9efdbb6 +--- /dev/null ++++ b/unbound-1.24.2/testdata/errreport_agent_domain_len.rpl +@@ -0,0 +1,221 @@ ++; Test DNS Error Reporting. ++ ++server: ++ module-config: "validator iterator" ++ trust-anchor-signaling: no ++ target-fetch-policy: "0 0 0 0 0" ++ verbosity: 4 ++ qname-minimisation: no ++ minimal-responses: no ++ rrset-roundrobin: no ++ trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b" ++ val-override-date: "20201020135527" ++ ede: no # It is not needed for dns-error-reporting; only for clients to receive EDEs ++ dns-error-reporting: yes ++ do-ip6: no ++ local-zone: test. nodefault ++ log-servfail: yes ++ ++stub-zone: ++ name: test ++ stub-addr: 1.2.3.5 ++stub-zone: ++ name: an.agent ++ stub-addr: 0.0.0.2 ++CONFIG_END ++ ++SCENARIO_BEGIN Test DNS Error Reporting with agent domain len malformed. ++ ++; ns.test ++RANGE_BEGIN 0 100 ++ ADDRESS 1.2.3.5 ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++test. IN NS ++SECTION ANSWER ++test. IN NS ns.test ++test. 3600 IN RRSIG NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s= ++SECTION ADDITIONAL ++ns.test. IN A 1.2.3.5 ++ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.test. IN A ++SECTION ANSWER ++ns.test. IN A 1.2.3.5 ++ns.test. 3600 IN RRSIG A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.test. IN AAAA ++SECTION AUTHORITY ++test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600 ++test. 3600 IN RRSIG SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw= ++ns.test. 3600 IN NSEC nz.test. A RRSIG ++ns.test. 3600 IN RRSIG NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++test. IN DNSKEY ++SECTION ANSWER ++test. 3600 IN DNSKEY 257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b} ++test. 3600 IN RRSIG DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc= ++SECTION ADDITIONAL ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qname qtype ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++example.test. IN DS ++SECTION ANSWER ++example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 ++example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode subdomain ++ADJUST copy_id copy_query ++REPLY QR NOERROR ++SECTION QUESTION ++example.test. IN NS ++SECTION AUTHORITY ++example.test. IN NS ns.example.test. ++example.test. 3600 IN DS 55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39 ++example.test. 3600 IN RRSIG DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I= ++SECTION ADDITIONAL ++ns.example.test. IN A 1.2.3.4 ++ENTRY_END ++RANGE_END ++ ++; ns.example.test. ++RANGE_BEGIN 0 100 ++ ADDRESS 1.2.3.4 ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR NOERROR ++SECTION QUESTION ++example.test. IN NS ++SECTION ANSWER ++example.test. IN NS ns.example.test. ++example.test. 3600 IN RRSIG NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4= ++SECTION ADDITIONAL ++ns.example.test. IN A 1.2.3.4 ++ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.example.test. IN A ++SECTION ANSWER ++ns.example.test. IN A 1.2.3.4 ++ns.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo= ++ENTRY_END ++ ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++ns.example.test. IN AAAA ++SECTION AUTHORITY ++example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 ++example.test. 3600 IN RRSIG SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8= ++ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG ++example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600 ++ENTRY_END ++ ++; response to DNSKEY priming query ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR NOERROR ++SECTION QUESTION ++example.test. IN DNSKEY ++SECTION ANSWER ++example.test. 3600 IN DNSKEY 257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b} ++example.test. 3600 IN RRSIG DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g= ++ENTRY_END ++ ++; response to query of interest ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR AA NOERROR ++SECTION QUESTION ++www.example.test. IN A ++SECTION ANSWER ++www.example.test. 3600 IN A 10.20.30.40 ++; valid signature ++;www.example.test. 3600 IN RRSIG A 8 3 3600 20201116135527 20201019135527 55567 example.test. OQEgDcpez8Bvdwd+hxA3v63FWJhutWkv9w+k+8RLcWv34WPhebsf7CBV74ggY2c+HafvYiuIFfhdF5CX28YQjxqWVzFgE6bEA6spPc6qdHiQaY/096/4SLCDcL+2EtOqcR/uZGj5uNhhaCJ9UjscBKfEZmHUOAMXKmjsvl0I/+I= ++; invalid: expired signature ++www.example.test. 3600 IN RRSIG A 8 3 3600 20200816135527 20200719135527 55567 example.test. DNM4PJALboBNDe5pJ2NScYqYYmmpq8E0NogjbDNithIcQ7HtzkssLIR46DiPb/B7QIhBRpfQ6sUwMb4l+NDhm82DxaecEwnAV6Y0zYK6dZ5jI7e8rDI2hkW/LO75qSZ8Y1I9pgX5uyeBCon42IVjc3vyYbRbFNv1xgJs5rk308U= ++SECTION ADDITIONAL ++HEX_EDNSDATA_BEGIN ++; This dns error reporting option is malformed, with garbage at end. ++ 00 12 ; opt-code (Report-Channel) ++ 00 28 ; opt-len 10 + 30 ++ 02 61 6E 05 61 67 65 6E 74 00 ; an.agent. ++ ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ; 30 0xFF tail ++ ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ++HEX_EDNSDATA_END ++ENTRY_END ++RANGE_END ++ ++; an.agent ++RANGE_BEGIN 10 20 ++ ADDRESS 0.0.0.2 ++ENTRY_BEGIN ++MATCH opcode qtype qname ++ADJUST copy_id ++REPLY QR NOERROR ++SECTION QUESTION ++_er.1.www.example.test.7._er.an.agent. IN TXT ++SECTION ANSWER ++_er.1.www.example.test.7._er.an.agent. IN TXT "OK" ++ENTRY_END ++RANGE_END ++ ++; Query again ++STEP 10 QUERY ++ENTRY_BEGIN ++REPLY RD ++SECTION QUESTION ++www.example.test. IN A ++ENTRY_END ++ ++; Check that validation failed ++; (a DNS Error Report query should have been generated) ++STEP 11 CHECK_ANSWER ++ENTRY_BEGIN ++MATCH all ++REPLY QR RD RA SERVFAIL ++SECTION QUESTION ++www.example.test. IN A ++ENTRY_END ++ ++; answer the reporting agent reply. ++STEP 20 TRAFFIC ++ ++SCENARIO_END +-- +2.55.0 + diff --git a/unbound-1.25.2-CVE-2026-55973.patch b/unbound-1.25.2-CVE-2026-55973.patch new file mode 100644 index 0000000..fe4d472 --- /dev/null +++ b/unbound-1.25.2-CVE-2026-55973.patch @@ -0,0 +1,29 @@ +diff --git a/unbound-1.24.2/services/cache/dns.c b/unbound-1.24.2/services/cache/dns.c +index 8dae2ffc..e4678353 100644 +--- a/unbound-1.24.2/services/cache/dns.c ++++ b/unbound-1.24.2/services/cache/dns.c +@@ -259,6 +259,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen, + + /* snip off front label */ + lablen = *qname; ++ if(lablen == 0) ++ break; + qname += lablen + 1; + qnamelen -= lablen + 1; + } +diff --git a/unbound-1.24.2/services/mesh.c b/unbound-1.24.2/services/mesh.c +index 23499dce..f87b6b78 100644 +--- a/unbound-1.24.2/services/mesh.c ++++ b/unbound-1.24.2/services/mesh.c +@@ -1616,9 +1616,9 @@ static void dns_error_reporting(struct module_qstate* qstate, + opt = edns_opt_list_find(qstate->edns_opts_back_in, + LDNS_EDNS_REPORT_CHANNEL); + if(!opt) return; +- agent_domain_len = opt->opt_len; + agent_domain = opt->opt_data; +- if(dname_valid(agent_domain, agent_domain_len) < 3) { ++ agent_domain_len = dname_valid(agent_domain, opt->opt_len); ++ if(agent_domain_len < 3) { + /* The agent domain needs to be a valid dname that is not the + * root; from RFC9567. */ + return; diff --git a/unbound.spec b/unbound.spec index 6edac51..4bbb8a8 100644 --- a/unbound.spec +++ b/unbound.spec @@ -37,7 +37,7 @@ Summary: Validating, recursive, and caching DNS(SEC) resolver Name: unbound Version: 1.24.2 -Release: 7%{?extra_version:-e %{extra_version}}%{?dist}.2 +Release: 7%{?extra_version:-e %{extra_version}}%{?dist}.4 License: BSD-3-Clause Url: https://nlnetlabs.nl/projects/unbound/ Source: https://nlnetlabs.nl/downloads/%{name}/%{name}-%{version}%{?extra_version}.tar.gz @@ -93,6 +93,14 @@ Patch9: unbound-1.25.1-CVE-2026-44390.patch Patch10: unbound-1.25.1-CVE-2026-41292.patch # https://nlnetlabs.nl/downloads/unbound/patch_CVE-2026-42534.diff Patch11: unbound-1.25.1-CVE-2026-42534.patch +# https://github.com/NLnetLabs/unbound/commit/f7637a4f1811f4a9331707d8a95cf0af65a97c0f +Patch12: unbound-1.25.2-CVE-2026-44690.patch +# https://github.com/NLnetLabs/unbound/commit/3d5e6c06923eff9eac2f5e31a69c43a15ca9d3c2 +Patch13: unbound-1.25.2-CVE-2026-44690-test.patch +# https://github.com/NLnetLabs/unbound/commit/96f875552023c0ccf376ebe050519f12f3371dc9 +Patch14: unbound-1.25.2-CVE-2026-55973.patch +# https://github.com/NLnetLabs/unbound/commit/b08723ef9736cd1246ef285360865f00cfa7e2ad +Patch15: unbound-1.25.2-CVE-2026-55973-test.patch BuildRequires: gcc BuildRequires: make @@ -572,6 +580,15 @@ popd %changelog ## START: Generated by rpmautospec +* Wed Aug 05 2026 Fedor Vorobev - 1.24.2-18 +- Add unit tests for CVE-2026-{44690,55973} + +* Wed Aug 05 2026 RHEL Packaging Agent - 1.24.2-17 +- Fix CVE-2026-55973: dns-error-reporting stack buffer overflow + +* Wed Aug 05 2026 RHEL Packaging Agent - 1.24.2-16 +- Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning + * Wed Jun 24 2026 Fedor Vorobev - 1.24.2-15 - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance