From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: =?utf-8?b?UGV0ciBNZW7FocOtayA8cGVtZW5zaWtAcmVkaGF0LmNvbT4=?= To: git-commits@fedoraproject.org Subject: [rpms/bind] rawhide: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) Date: Tue, 25 Aug 2026 19:32:50 GMT Message-ID: <178768637068.1.304935857171209325.rpms-bind-3a99b5a25e4c@fedoraproject.org> List-ID: X-Git-Repo: rpms/bind X-Git-Branch: rawhide X-Git-Rev: 3a99b5a25e4ce9e1ff97709cf96a9150b02bb2bb ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvYmluZAogICAgICAgICAgICBCcmFuY2ggOiByYXdoaWRlCiAgICAgICAgICAg IENvbW1pdCA6IDNhOTliNWEyNWU0Y2U5ZTFmZjk3NzA5Y2Y5NmE5MTUwYjAyYmIyYmIKICAgICAg ICAgICAgQXV0aG9yIDogUGV0ciBNZW7FocOtayA8cGVtZW5zaWtAcmVkaGF0LmNvbT4KICAgICAg ICAgICAgRGF0ZSAgIDogMjAyNi0wOC0yNVQxMjozOTozMCswMjowMAogICAgICAgICAgICBTdGF0 cyAgOiArMTA0Ly0wIGluIDMgZmlsZShzKQogICAgICAgICAgICBVUkwgICAgOiBodHRwczovL3Ny Yy5mZWRvcmFwcm9qZWN0Lm9yZy9ycG1zL2JpbmQvYy8zYTk5YjVhMjVlNGNlOWUxZmY5NzcwOWNm OTZhOTE1MGIwMmJiMmJiP2JyYW5jaD1yYXdoaWRlCgogICAgICAgICAgICBMb2c6CiAgICAgICAg ICAgIFBvdGVudGlhbCB3aWxkY2FyZCBDTkFNRSBSUFogcG9saWN5IGJ5cGFzcyAoQ1ZFLTIwMjYt MTEzMzEpCgpbOS4xOF0gW0NWRS0yMDI2LTExMzMxXSBzZWM6IHVzcjogRml4IGhhbmRsaW5nIG9m IHJweiBDTkFNRSBleHBhbnNpb24gdGhhdCByZXR1cm5zIG5hbWUgdG9vIGxvbmcKClByZXZpb3Vz bHksIGlmIHRoZSBleHBhbnNpb24gb2YgYSB3aWxkY2FyZCBDTkFNRSBSUFogcG9saWN5IHJlc3Vs dGVkIGluIGEgbmFtZSB0aGF0IGV4Y2VlZGVkIHRoZSBsZW5ndGggbGltaXQsIGEgc2VsZiByZWZl cmVudGlhbCBDTkFNRSBhbmQgdGhlIG9yaWdpbmFsIGFkZHJlc3MgcmVjb3JkIHdlcmUgcmV0dXJu ZWQsIGFsbG93aW5nIHRoZSBwb2xpY3kgdG8gYmUgYnlwYXNzZWQuICBJbiBicmFuY2hlcyB1cCB0 byA5LjIwLCB0aGlzIGFsc28gbGVmdCBxdWVyeSBwcm9jZXNzaW5nIGluIGFuIGluY29uc2lzdGVu dCBzdGF0ZSB3aGljaCBjb3VsZCB0cmlnZ2VyIGFuIGFzc2VydGlvbiBmYWlsdXJlLiAgV2Ugbm93 IHJldHVybiBhIFlYRE9NQUlOIHJlc3BvbnNlLCB3aXRob3V0IHRoZSBhZGRyZXNzLgoKSVNDIHdv dWxkIGxpa2UgdG8gdGhhbmsgTGFpdGggTWFzaCdhbCAoMHhtc2hhbCkgZm9yIGJyaW5naW5nIHRo aXMgaXNzdWUgdG8gb3VyIGF0dGVudGlvbi4KCkNsb3NlcyBodHRwczovL2dpdGxhYi5pc2Mub3Jn L2lzYy1wcm9qZWN0cy9iaW5kOS8tL2lzc3Vlcy81ODU2CgotLS0KZGlmZiAtLWdpdCBhL2JpbmQt OS4xOC1DVkUtMjAyNi0xMTMzMS10ZXN0LnBhdGNoIGIvYmluZC05LjE4LUNWRS0yMDI2LTExMzMx LXRlc3QucGF0Y2gKbmV3IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uMjdhYTZjYwot LS0gL2Rldi9udWxsCisrKyBiL2JpbmQtOS4xOC1DVkUtMjAyNi0xMTMzMS10ZXN0LnBhdGNoCkBA IC0wLDAgKzEsNjkgQEAKK0Zyb20gY2RlOGJiMjFlMDkyMDVhN2JkMWY0MWZkMDdlZDAxMWZjODBk OGQ3MSBNb24gU2VwIDE3IDAwOjAwOjAwIDIwMDEKK0Zyb206IE1hcmsgQW5kcmV3cyA8bWFya2FA aXNjLm9yZz4KK0RhdGU6IEZyaSwgMTAgQXByIDIwMjYgMTA6MjQ6MDYgKzEwMDAKK1N1YmplY3Q6 IFtQQVRDSF0gRml4IFRUTCBleHRyYWN0aW9uIGZyb20gQS9BQUFBIHJlY29yZAorCisoY2hlcnJ5 IHBpY2tlZCBmcm9tIGNvbW1pdCA4OWM4NmUzMzhkYjI0OTJiOTJlNjYxOGM1ODZmMTQ2YzY5Mjhk YzZkKQorKGNoZXJyeSBwaWNrZWQgZnJvbSBjb21taXQgYWRjODI4NWQyM2UyZWFjNmVjNDYzZjVk YmM1YTk1OTZmZGQzNmM2MCkKKworQ2hlY2sgcnB6IG5hbWUgdG9vIGxvbmcgd2lsZGNhcmQgQ05B TUUgZXhwYW5zaW9uIGhhbmRsaW5nCisKKyhjaGVycnkgcGlja2VkIGZyb20gY29tbWl0IDkzNDUz OTRlMjA5NzAzMWI1NWIzZWYzNGNlYWFkZjVhN2ViYmVlZjIpCisoY2hlcnJ5IHBpY2tlZCBmcm9t IGNvbW1pdCAwOTViMTFmMjBmOTExZjViODA1OWJkYzM0OWIyNTZkNmM2NGVjZTMwKQorLS0tCisg YmluL3Rlc3RzL3N5c3RlbS9ycHovbnMyL3RsZDIuZGIgfCAyICsrCisgYmluL3Rlc3RzL3N5c3Rl bS9ycHovbnM0L3RsZDQuZGIgfCAyICsrCisgYmluL3Rlc3RzL3N5c3RlbS9ycHovdGVzdHMuc2gg ICAgfCA3ICsrKysrLS0KKyAzIGZpbGVzIGNoYW5nZWQsIDkgaW5zZXJ0aW9ucygrKSwgMiBkZWxl dGlvbnMoLSkKKworZGlmZiAtLWdpdCBhL2Jpbi90ZXN0cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRi IGIvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnMyL3RsZDIuZGIKK2luZGV4IGM2ZjI1NTZkYjUuLmMw OTFlZTI3YjcgMTAwNjQ0CistLS0gYS9iaW4vdGVzdHMvc3lzdGVtL3Jwei9uczIvdGxkMi5kYgor KysrIGIvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnMyL3RsZDIuZGIKK0BAIC0xMjMsMyArMTIzLDUg QEAgYTctMQkJQQkxOTIuMTY4LjcuMQorIAorIGE3LTIJCUEJMTkyLjE2OC43LjIKKyAJCVRYVAki YTctMiB0bGQyIHRleHQiCisrCisrKi53aWxkCQlBCTE5Mi4xNjguOS4xCitkaWZmIC0tZ2l0IGEv YmluL3Rlc3RzL3N5c3RlbS9ycHovbnM0L3RsZDQuZGIgYi9iaW4vdGVzdHMvc3lzdGVtL3Jwei9u czQvdGxkNC5kYgoraW5kZXggZmNhNDE5YzZkZC4uOGFjY2Q3NmJhZiAxMDA2NDQKKy0tLSBhL2Jp bi90ZXN0cy9zeXN0ZW0vcnB6L25zNC90bGQ0LmRiCisrKysgYi9iaW4vdGVzdHMvc3lzdGVtL3Jw ei9uczQvdGxkNC5kYgorQEAgLTU5LDYgKzU5LDggQEAgYTMtNi50bGQyCUEJNTYuNTYuNTYuNTYK KyAKKyBhMy03LnN1YjEudGxkMglBCTU3LjU3LjU3LjU3CisgCisrKi53aWxkLnN1YjEudGxkMglB CTU3LjU3LjU3LjU3CisrCisgYTMtOC50bGQyCUEJNTguNTguNTguNTgKKyAKKyBhMy05LnN1Yjku dGxkMglBCTU5LjU5LjU5LjU5CitkaWZmIC0tZ2l0IGEvYmluL3Rlc3RzL3N5c3RlbS9ycHovdGVz dHMuc2ggYi9iaW4vdGVzdHMvc3lzdGVtL3Jwei90ZXN0cy5zaAoraW5kZXggODdlNDExOGNhMy4u NTI5NzQzNzY5NCAxMDA2NDQKKy0tLSBhL2Jpbi90ZXN0cy9zeXN0ZW0vcnB6L3Rlc3RzLnNoCisr KysgYi9iaW4vdGVzdHMvc3lzdGVtL3Jwei90ZXN0cy5zaAorQEAgLTM5MSw3ICszOTEsNyBAQCBh ZGRyKCkgeworICAgZGlnY21kICQyID4kRElHTk0KKyAgICNja2FsaXZlICIkMiIgInNlcnZlciBj cmFzaGVkIGJ5ICdkaWcgJDInIiB8fCByZXR1cm4gMQorICAgQUREUl9FU0M9JChlY2hvICIkQURE UiIgfCBzZWQgLWUgJ3MvXC4vXFwuL2cnKQorLSAgQUREUl9UVEw9JChzZWQgLW4gLWUgInMvXlst LmEtejAtOV1cezEsXH1bCSBdKlwoWzAtOV0qXCkJSU4JQUEqCSR7QUREUl9FU0N9XCQvXDEvcCIg JERJR05NKQorKyAgQUREUl9UVEw9JChzZWQgLW4gLWUgInMvXlstLmEtejAtOV1cezEsXH1bCSBd KlwoWzAtOV0qXClbIAldSU5bIAldQUEqWyAJXSR7QUREUl9FU0N9XCQvXDEvcCIgJERJR05NKQor ICAgaWYgdGVzdCAteiAiJEFERFJfVFRMIjsgdGhlbgorICAgICBzZXRyZXQgIidkaWcgJDInIHdy b25nOyBubyBhZGRyZXNzICRBRERSIHJlY29yZCBpbiAkRElHTk0iCisgICAgIHJldHVybiAwCitA QCAtNTE2LDcgKzUxNiwxMCBAQCBub2NoYW5nZSBUQ1AgYTMtOS50bGQyICAgICAgICAgICAgICAg ICMgMzMgdGNwLW9ubHkKKyBoZXJlIHguc2VydmZhaWwgPDwnRU9GJyAgICAgICAgICAgICAgICMg MzQgcW5hbWUtd2FpdC1yZWN1cnNlIHllcworICAgOzsgc3RhdHVzOiBTRVJWRkFJTCwgeAorIEVP RgorLWFkZHIgMzUuMzUuMzUuMzUgInguc2VydmZhaWwgQCRuczUiICMgMzUgcW5hbWUtd2FpdC1y ZWN1cnNlIG5vCisrYWRkciAzNS4zNS4zNS4zNSAieC5zZXJ2ZmFpbCBAJG5zNSIgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAjIDM1IHFuYW1l LXdhaXQtcmVjdXJzZSBubworK2hlcmUgYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWEuYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWFhLmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYS5hYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhLndpbGQuc3ViMS50bGQyIDw8J0VPRicgIyAz NiB3aWxkY2FyZCBDTkFNRSBuYW1lIHRvIGxvbmcKKysgICAgOzsgc3RhdHVzOiBZWERPTUFJTiwg eAorK0VPRgorIGVuZF9ncm91cAorIGNrc3RhdHMgJG5zMyB0ZXN0MSBuczMgMjIKKyBja3N0YXRz ICRuczUgdGVzdDEgbnM1IDEKKy0tIAorMi41NS4wCisKCmRpZmYgLS1naXQgYS9iaW5kLTkuMTgt Q1ZFLTIwMjYtMTEzMzEucGF0Y2ggYi9iaW5kLTkuMTgtQ1ZFLTIwMjYtMTEzMzEucGF0Y2gKbmV3 IGZpbGUgbW9kZSAxMDA2NDQKaW5kZXggMDAwMDAwMC4uOGJhYTk4YwotLS0gL2Rldi9udWxsCisr KyBiL2JpbmQtOS4xOC1DVkUtMjAyNi0xMTMzMS5wYXRjaApAQCAtMCwwICsxLDMxIEBACitGcm9t IDQ5ZjRjYzRlOTNmMTRmMWQ1YjZhNDcyMTI0ZTZhYTQ1NzE2N2ZlZGUgTW9uIFNlcCAxNyAwMDow MDowMCAyMDAxCitGcm9tOiBNYXJrIEFuZHJld3MgPG1hcmthQGlzYy5vcmc+CitEYXRlOiBGcmks IDEwIEFwciAyMDI2IDEwOjI2OjE0ICsxMDAwCitTdWJqZWN0OiBbUEFUQ0hdIFByb3Blcmx5IGhh bmRsZSBycHogbmFtZSB0byBsb25nIHdpbGRjYXJkIGV4cGFuc2lvbgorCitQcmV2aW91c2x5IGEg c2VsZiByZWZlcmVudGlhbCBDTkFNRSBhbmQgdGhlIG9yaWdpbmFsIGFkZHJlc3MKK3JlY29yZCB3 ZXJlIHJldHVybmVkLiAgV2Ugbm93IHJldHVybiBhIFlYRE9NQUlOIHJlc3BvbnNlLgorCisoY2hl cnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCBjZmM0YzRmNjk4NzBjZTQ5MmRlYWFhNDI5NDUzNTYzZDE2 MjFkZWQzKQorKGNoZXJyeSBwaWNrZWQgZnJvbSBjb21taXQgZGMzMjhhMTk5Zjk2MjIyZTBjMzBj YzIwYjdiNzk1YmZjMmM5YjJlNCkKKy0tLQorIGxpYi9ucy9xdWVyeS5jIHwgMyArKy0KKyAxIGZp bGUgY2hhbmdlZCwgMiBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9uKC0pCisKK2RpZmYgLS1naXQg YS9saWIvbnMvcXVlcnkuYyBiL2xpYi9ucy9xdWVyeS5jCitpbmRleCBkM2ExMGJlOWJhLi4zYmQ3 ZGFmNzljIDEwMDY0NAorLS0tIGEvbGliL25zL3F1ZXJ5LmMKKysrKyBiL2xpYi9ucy9xdWVyeS5j CitAQCAtNzU5MSw3ICs3NTkxLDggQEAgcXVlcnlfcnB6Y25hbWUocXVlcnlfY3R4X3QgKnFjdHgs IGRuc19uYW1lX3QgKmNuYW1lKSB7CisgCQkJCQkgICAgICBxY3R4LT5mbmFtZSwgTlVMTCk7Cisg CQlpZiAocmVzdWx0ID09IEROU19SX05BTUVUT09MT05HKSB7CisgCQkJY2xpZW50LT5tZXNzYWdl LT5yY29kZSA9IGRuc19yY29kZV95eGRvbWFpbjsKKy0JCX0gZWxzZSBpZiAocmVzdWx0ICE9IElT Q19SX1NVQ0NFU1MpIHsKKysJCX0KKysJCWlmIChyZXN1bHQgIT0gSVNDX1JfU1VDQ0VTUykgewor IAkJCXJldHVybiByZXN1bHQ7CisgCQl9CisgCX0gZWxzZSB7CistLSAKKzIuNTUuMAorCgpkaWZm IC0tZ2l0IGEvYmluZC5zcGVjIGIvYmluZC5zcGVjCmluZGV4IGEyOWJhZDguLmJiZTY3N2QgMTAw NjQ0Ci0tLSBhL2JpbmQuc3BlYworKysgYi9iaW5kLnNwZWMKQEAgLTE2MCw2ICsxNjAsMTAgQEAg UGF0Y2gzMzogYmluZC05LjE4LWRpZy1pZG4taW5wdXQtYWx3YXlzLnBhdGNoCiBQYXRjaDM0OiBi aW5kLTkuMTgtZGlnLWlkbi1pbnB1dC1hbHdheXMtdGVzdC5wYXRjaAogIyBkb3duc3RyZWFtIG9u bHksIGh0dHBzOi8vcmVkaGF0LmF0bGFzc2lhbi5uZXQvYnJvd3NlL0lETS02MTg5CiBQYXRjaDM1 OiAwMDAxLVVzZS12YXJpYWJsZS1QUk9HUkFNX1NVRkZJWC1pbi1pbnN0YWxsLXRhcmdldC5wYXRj aAorIyBodHRwczovL2dpdGxhYi5pc2Mub3JnL2lzYy1wcm9qZWN0cy9iaW5kOS9jb21taXQvNGZk MDc1NWJkZDA4NDcxZjc0ZTZlNGM3NmNkMjMyNmYzNTZlMGE2MQorIyBodHRwczovL2dpdGxhYi5p c2Mub3JnL2lzYy1wcm9qZWN0cy9iaW5kOS8tL3dvcmtfaXRlbXMvNTg1NgorUGF0Y2gzNjogYmlu ZC05LjE4LUNWRS0yMDI2LTExMzMxLnBhdGNoCitQYXRjaDM3OiBiaW5kLTkuMTgtQ1ZFLTIwMjYt MTEzMzEtdGVzdC5wYXRjaAogCiAlez9zeXN0ZW1kX29yZGVyaW5nfQogIyBodHRwczovL2ZlZG9y YXByb2plY3Qub3JnL3dpa2kvQ2hhbmdlcy9SUE1TdXBvcnRGb3JTeXN0ZW1kU3lzdXNlcnMK