fix(cve): CVE-2026-13204 - dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3#10
Merged
Conversation
…ned NSEC/NSEC3 CVE: CVE-2026-13204 (high) - dns_rdataset_addnoqname() 可能找到未签名的 NSEC/NSEC3 Upstream: isc-projects/bind9@4730903 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
|
TAG Bot TAG: 1%9.20.23-1_deb13u1deepin10 |
Contributor
Author
|
/hold |
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
CVE: CVE-2026-12617 (high) - The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. Upstream: isc-projects/bind9@773d46d Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…rence counted CVE: CVE-2026-11622 (high) - A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the parameter. Upstream: isc-projects/bind9@2dabf11 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…s_nsec_is_legal CVE: CVE-2026-13321 (high) - 修复 NSEC 记录验证逻辑，将 dns_nsec_requiredtypespresent 函数重命名为 dns_nsec_is_legal，并增加对区域外 NSEC 条目的检查 Upstream: isc-projects/bind9@27ceccf Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…etch CVE: CVE-2026-11605 (high) - DNSSEC 否认证明验证未限制每获取请求的验证计数，可能导致拒绝服务攻击 Upstream: isc-projects/bind9@c338837 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…ling of rpz CNAME expansion th CVE: CVE-2026-11331 (high) - 修复 rpz CNAME 扩展返回名称过长时的处理问题 Upstream: isc-projects/bind9@b950da5 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
…d DNSKEY records could trigger CVE: CVE-2026-10822 (medium) - Malformed DNSKEY records could trigger an assertion Upstream: isc-projects/bind9@9a82af7 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
CVE: CVE-2026-10723 (medium) - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. Upstream: https://gitlab.isc.org/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
… accepted CVE: CVE-2026-11721 (high) - It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set (which is the default). Upstream: isc-projects/bind9@8a46533 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: qwen3.6-35b
Contributor
|
/integrate |
|
AutoIntegrationPr Bot |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-13204 (high) - dns_rdataset_addnoqname() 可能找到未签名的 NSEC/NSEC3
Upstream: isc-projects/bind9@4730903
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-12617 (high) - The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A record below the DNAME to the resolver, and the authoritative server responds positively to the A query but delays the DNAME response and later responds negatively, named may quit unexpectedly. Or, if a client queries for a CNAME and A record for the same name to the resolver, and the authoritative server responds positively to the A query but delays the CNAME response and later responds with a self-referential CNAME, the same failure may occur. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.
Upstream: isc-projects/bind9@773d46d
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-11622 (high) - A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the resolver can perform validation. The increased memory usage can be orders of magnitude beyond the limit configured in the parameter.
Upstream: isc-projects/bind9@2dabf11
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-13321 (high) - 修复 NSEC 记录验证逻辑，将 dns_nsec_requiredtypespresent 函数重命名为 dns_nsec_is_legal，并增加对区域外 NSEC 条目的检查
Upstream: isc-projects/bind9@27ceccf
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-11605 (high) - DNSSEC 否认证明验证未限制每获取请求的验证计数，可能导致拒绝服务攻击
Upstream: isc-projects/bind9@c338837
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-11331 (high) - 修复 rpz CNAME 扩展返回名称过长时的处理问题
Upstream: isc-projects/bind9@b950da5
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-10822 (medium) - Malformed DNSKEY records could trigger an assertion
Upstream: isc-projects/bind9@9a82af7
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-10723 (medium) - BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.
Upstream: https://gitlab.isc.org/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b
CVE: CVE-2026-11721 (high) - It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For this attack to have any effect, the resolver under attack must have set (which is the default).
Upstream: isc-projects/bind9@8a46533
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: qwen3.6-35b