From 122de2529968533462d36324eb16080a5337b795 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Apr 29 2021 13:02:59 +0000 Subject: import bind-9.11.4-26.P2.el7_9.5 --- diff --git a/SOURCES/bind-9.11-CVE-2021-25215.patch b/SOURCES/bind-9.11-CVE-2021-25215.patch new file mode 100644 index 0000000..4f62a10 --- /dev/null +++ b/SOURCES/bind-9.11-CVE-2021-25215.patch @@ -0,0 +1,40 @@ +From 6fc38d1c75ce5a6172267e6ca162c4fdc09657ad Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Tue, 27 Apr 2021 10:56:12 +0200 +Subject: [PATCH 2/2] CVE-2021-25215 + +5616. [security] named crashed when a DNAME record placed in the ANSWER + section during DNAME chasing turned out to be the final + answer to a client query. (CVE-2021-25215) [GL #2540] +--- + bin/named/query.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/bin/named/query.c b/bin/named/query.c +index a95f5ad..11a888e 100644 +--- a/bin/named/query.c ++++ b/bin/named/query.c +@@ -9301,10 +9301,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype) + if (noqname != NULL) + query_addnoqnameproof(client, noqname); + /* +- * We shouldn't ever fail to add 'rdataset' +- * because it's already in the answer. ++ * 'rdataset' will only be non-NULL here if the ANSWER section ++ * of the message to be sent to the client already contains an ++ * RRset with the same owner name and the same type as ++ * 'rdataset'. This should never happen, with one exception: ++ * when chasing DNAME records, one of the DNAME records placed ++ * in the ANSWER section may turn out to be the final answer to ++ * the client's query, but we have no way of knowing that until ++ * now. In such a case, 'rdataset' will be freed later, so we ++ * do not need to free it here. + */ +- INSIST(rdataset == NULL); ++ INSIST(rdataset == NULL || qtype == dns_rdatatype_dname); + } + + addauth: +-- +2.26.3 + diff --git a/SPECS/bind.spec b/SPECS/bind.spec index 602b5bd..e2c34f2 100644 --- a/SPECS/bind.spec +++ b/SPECS/bind.spec @@ -64,7 +64,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: MPLv2.0 Version: 9.11.4 -Release: 26%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.4 +Release: 26%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.5 Epoch: 32 Url: http://www.isc.org/products/BIND/ # @@ -178,6 +178,7 @@ Patch191: bind-9.11-CVE-2020-8624.patch Patch192: bind98-rh1769876.patch Patch193: bind-9.11-rh1889902.patch Patch194: bind-9.11-CVE-2020-8625.patch +Patch195: bind-9.11-CVE-2021-25215.patch # SDB patches Patch11: bind-9.3.2b2-sdbsrc.patch @@ -549,6 +550,7 @@ are used for building ISC DHCP. %patch192 -p1 -b .rh1769876 %patch193 -p1 -b .rh1889902 %patch194 -p1 -b .CVE-2020-8625 +%patch195 -p1 -b .CVE-2021-25215 # Override upstream builtin keys cp -fp %{SOURCE29} bind.keys @@ -1530,6 +1532,9 @@ rm -rf ${RPM_BUILD_ROOT} %changelog +* Tue Apr 27 2021 Petr Menšík - 32:9.11.4-26.P2.5 +- Possible assertion failure on DNAME processing (CVE-2021-25215) + * Mon Feb 15 2021 Petr Menšík - 32:9.11.4-26.P2.4 - Fix off-by-one bug in ISC SPNEGO implementation (CVE-2020-8625)