Skip to content

Commit efda53e

Browse files
deepin-ci-robothudeng-go
authored and
Security Team
committed
* Fix CVE-2026-1519: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. Upstream: https://gitlab.isc.org/isc-projects/bind9/-/commit/ef01ff31db4be0d737949fd785fa52c491041eb4 * Fix CVE-2026-3104: Fix memory leaks in code preparing DNSSEC proofs of non-existence. Upstream: https://gitlab.isc.org/isc-projects/bind9/-/commit/5f15df5c53a445846083c46a9437910f8f6c3127 Co-Authored-By: hudeng <hudeng@deepin.org> Signed-off-by: Security Team <security@deepin.org>
1 parent 11e63d9 commit efda53e

4 files changed

Lines changed: 159 additions & 0 deletions

File tree

‎debian/changelog‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,14 @@
1+
bind9 (1:9.20.18-1~deb13u1deepin2) unstable; urgency=high
2+
3+
* Fix CVE-2026-1519: Fix unbounded NSEC3 iterations when validating
4+
referrals to unsigned delegations.
5+
Upstream: https://gitlab.isc.org/isc-projects/bind9/-/commit/ef01ff31db4be0d737949fd785fa52c491041eb4
6+
* Fix CVE-2026-3104: Fix memory leaks in code preparing DNSSEC proofs
7+
of non-existence.
8+
Upstream: https://gitlab.isc.org/isc-projects/bind9/-/commit/5f15df5c53a445846083c46a9437910f8f6c3127
9+
10+
-- Security Team <security@deepin.org> Mon, 13 Apr 2026 11:16:00 +0800
11+
112
bind9 (1:9.20.18-1~deb13u1deepin1) unstable; urgency=medium
213

314
* Disable Build-Dep xindy for sunway.

‎debian/patches/CVE-2026-1519.patch‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
Description: Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations
2+
Origin: upstream, https://gitlab.isc.org/isc-projects/bind9/-/commit/ef01ff31db4be0d737949fd785fa52c491041eb4
3+
Bug: CVE-2026-1519
4+
Last-Update: 2026-04-13
5+
6+
--- a/lib/dns/validator.c
7+
+++ b/lib/dns/validator.c
8+
@@ -2804,7 +2804,19 @@ validate_neg_rrset(dns_validator_t *val, dns_name_t *name,
9+
}
10+
}
11+
12+
+ if (rdataset->type != dns_rdatatype_nsec &&
13+
+ DNS_TRUST_SECURE(rdataset->trust))
14+
+ {
15+
+ /*
16+
+ * The negative response data is already verified.
17+
+ * We skip NSEC records, because they require special
18+
+ * processing in validator_callback_nsec().
19+
+ */
20+
+ return DNS_R_CONTINUE;
21+
+ }
22+
+
23+
val->nxset = rdataset;
24+
+
25+
result = create_validator(val, name, rdataset->type, rdataset,
26+
sigrdataset, validator_callback_nsec,
27+
"validate_neg_rrset");
28+
@@ -2914,11 +2926,9 @@ validate_ncache(dns_validator_t *val, bool resume) {
29+
}
30+
31+
result = validate_neg_rrset(val, name, rdataset, sigrdataset);
32+
- if (result == DNS_R_CONTINUE) {
33+
- continue;
34+
+ if (result != DNS_R_CONTINUE) {
35+
+ return result;
36+
}
37+
-
38+
- return result;
39+
}
40+
if (result == ISC_R_NOMORE) {
41+
result = ISC_R_SUCCESS;

‎debian/patches/CVE-2026-3104.patch‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
Description: Fix memory leaks in code preparing DNSSEC proofs of non-existence
2+
Origin: upstream, https://gitlab.isc.org/isc-projects/bind9/-/commit/5f15df5c53a445846083c46a9437910f8f6c3127
3+
Bug: CVE-2026-3104
4+
Last-Update: 2026-04-13
5+
6+
--- a/lib/dns/qpcache.c
7+
+++ b/lib/dns/qpcache.c
8+
@@ -3279,7 +3279,7 @@ addnoqname(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
9+
dns_slabheader_proof_t *noqname = NULL;
10+
dns_name_t name = DNS_NAME_INITEMPTY;
11+
dns_rdataset_t neg = DNS_RDATASET_INIT, negsig = DNS_RDATASET_INIT;
12+
- isc_region_t r1, r2;
13+
+ isc_region_t r1 = { .base = NULL }, r2 = { .base = NULL };
14+
15+
result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
16+
RUNTIME_CHECK(result == ISC_R_SUCCESS);
17+
@@ -3305,6 +3305,14 @@ addnoqname(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
18+
newheader->noqname = noqname;
19+
20+
cleanup:
21+
+ if (result != ISC_R_SUCCESS) {
22+
+ if (r1.base != NULL) {
23+
+ isc_mem_put(mctx, r1.base, r1.length);
24+
+ }
25+
+ if (r2.base != NULL) {
26+
+ isc_mem_put(mctx, r2.base, r2.length);
27+
+ }
28+
+ }
29+
dns_rdataset_disassociate(&neg);
30+
dns_rdataset_disassociate(&negsig);
31+
32+
@@ -3318,7 +3326,7 @@ addclosest(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
33+
dns_slabheader_proof_t *closest = NULL;
34+
dns_name_t name = DNS_NAME_INITEMPTY;
35+
dns_rdataset_t neg = DNS_RDATASET_INIT, negsig = DNS_RDATASET_INIT;
36+
- isc_region_t r1, r2;
37+
+ isc_region_t r1 = { .base = NULL }, r2 = { .base = NULL };
38+
39+
result = dns_rdataset_getclosest(rdataset, &name, &neg, &negsig);
40+
RUNTIME_CHECK(result == ISC_R_SUCCESS);
41+
@@ -3344,6 +3352,14 @@ addclosest(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
42+
newheader->closest = closest;
43+
44+
cleanup:
45+
+ if (result != ISC_R_SUCCESS) {
46+
+ if (r1.base != NULL) {
47+
+ isc_mem_put(mctx, r1.base, r1.length);
48+
+ }
49+
+ if (r2.base != NULL) {
50+
+ isc_mem_put(mctx, r2.base, r2.length);
51+
+ }
52+
+ }
53+
dns_rdataset_disassociate(&neg);
54+
dns_rdataset_disassociate(&negsig);
55+
return result;
56+
--- a/lib/dns/rbtdb.c
57+
+++ b/lib/dns/rbtdb.c
58+
@@ -3180,7 +3180,7 @@ addnoqname(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
59+
dns_slabheader_proof_t *noqname = NULL;
60+
dns_name_t name = DNS_NAME_INITEMPTY;
61+
dns_rdataset_t neg = DNS_RDATASET_INIT, negsig = DNS_RDATASET_INIT;
62+
- isc_region_t r1, r2;
63+
+ isc_region_t r1 = { .base = NULL }, r2 = { .base = NULL };
64+
65+
result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig);
66+
RUNTIME_CHECK(result == ISC_R_SUCCESS);
67+
@@ -3206,6 +3206,14 @@ addnoqname(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
68+
newheader->noqname = noqname;
69+
70+
cleanup:
71+
+ if (result != ISC_R_SUCCESS) {
72+
+ if (r1.base != NULL) {
73+
+ isc_mem_put(mctx, r1.base, r1.length);
74+
+ }
75+
+ if (r2.base != NULL) {
76+
+ isc_mem_put(mctx, r2.base, r2.length);
77+
+ }
78+
+ }
79+
dns_rdataset_disassociate(&neg);
80+
dns_rdataset_disassociate(&negsig);
81+
82+
@@ -3219,7 +3227,7 @@ addclosest(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
83+
dns_slabheader_proof_t *closest = NULL;
84+
dns_name_t name = DNS_NAME_INITEMPTY;
85+
dns_rdataset_t neg = DNS_RDATASET_INIT, negsig = DNS_RDATASET_INIT;
86+
- isc_region_t r1, r2;
87+
+ isc_region_t r1 = { .base = NULL }, r2 = { .base = NULL };
88+
89+
result = dns_rdataset_getclosest(rdataset, &name, &neg, &negsig);
90+
RUNTIME_CHECK(result == ISC_R_SUCCESS);
91+
@@ -3245,6 +3253,14 @@ addclosest(isc_mem_t *mctx, dns_slabheader_t *newheader, uint32_t maxrrperset,
92+
newheader->closest = closest;
93+
94+
cleanup:
95+
+ if (result != ISC_R_SUCCESS) {
96+
+ if (r1.base != NULL) {
97+
+ isc_mem_put(mctx, r1.base, r1.length);
98+
+ }
99+
+ if (r2.base != NULL) {
100+
+ isc_mem_put(mctx, r2.base, r2.length);
101+
+ }
102+
+ }
103+
dns_rdataset_disassociate(&neg);
104+
dns_rdataset_disassociate(&negsig);
105+
return result;

‎debian/patches/series‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,4 @@
11
0001-Disable-treat-warnings-as-errors-in-sphinx-build.patch
22
0002-Disable-RTLD_DEEPBIND-in-Samba-DLZ-module.patch
3+
CVE-2026-1519.patch
4+
CVE-2026-3104.patch

0 commit comments

Comments
 (0)