From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: =?utf-8?b?UGV0ciBNZW7FocOtayA8cGVtZW5zaWtAcmVkaGF0LmNvbT4=?= To: git-commits@fedoraproject.org Subject: [rpms/bind] f45: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) Date: Wed, 26 Aug 2026 08:34:46 GMT Message-ID: <178773328692.1.14299889557740872101.rpms-bind-3a99b5a25e4c@fedoraproject.org> List-ID: X-Git-Repo: rpms/bind X-Git-Branch: f45 X-Git-Rev: 3a99b5a25e4ce9e1ff97709cf96a9150b02bb2bb ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvYmluZAogICAgICAgICAgICBCcmFuY2ggOiBmNDUKICAgICAgICAgICAgQ29t bWl0IDogM2E5OWI1YTI1ZTRjZTllMWZmOTc3MDljZjk2YTkxNTBiMDJiYjJiYgogICAgICAgICAg ICBBdXRob3IgOiBQZXRyIE1lbsWhw61rIDxwZW1lbnNpa0ByZWRoYXQuY29tPgogICAgICAgICAg ICBEYXRlICAgOiAyMDI2LTA4LTI1VDEyOjM5OjMwKzAyOjAwCiAgICAgICAgICAgIFN0YXRzICA6 ICsxMDQvLTAgaW4gMyBmaWxlKHMpCiAgICAgICAgICAgIFVSTCAgICA6IGh0dHBzOi8vc3JjLmZl ZG9yYXByb2plY3Qub3JnL3JwbXMvYmluZC9jLzNhOTliNWEyNWU0Y2U5ZTFmZjk3NzA5Y2Y5NmE5 MTUwYjAyYmIyYmI/YnJhbmNoPWY0NQoKICAgICAgICAgICAgTG9nOgogICAgICAgICAgICBQb3Rl bnRpYWwgd2lsZGNhcmQgQ05BTUUgUlBaIHBvbGljeSBieXBhc3MgKENWRS0yMDI2LTExMzMxKQoK WzkuMThdIFtDVkUtMjAyNi0xMTMzMV0gc2VjOiB1c3I6IEZpeCBoYW5kbGluZyBvZiBycHogQ05B TUUgZXhwYW5zaW9uIHRoYXQgcmV0dXJucyBuYW1lIHRvbyBsb25nCgpQcmV2aW91c2x5LCBpZiB0 aGUgZXhwYW5zaW9uIG9mIGEgd2lsZGNhcmQgQ05BTUUgUlBaIHBvbGljeSByZXN1bHRlZCBpbiBh IG5hbWUgdGhhdCBleGNlZWRlZCB0aGUgbGVuZ3RoIGxpbWl0LCBhIHNlbGYgcmVmZXJlbnRpYWwg Q05BTUUgYW5kIHRoZSBvcmlnaW5hbCBhZGRyZXNzIHJlY29yZCB3ZXJlIHJldHVybmVkLCBhbGxv d2luZyB0aGUgcG9saWN5IHRvIGJlIGJ5cGFzc2VkLiAgSW4gYnJhbmNoZXMgdXAgdG8gOS4yMCwg dGhpcyBhbHNvIGxlZnQgcXVlcnkgcHJvY2Vzc2luZyBpbiBhbiBpbmNvbnNpc3RlbnQgc3RhdGUg d2hpY2ggY291bGQgdHJpZ2dlciBhbiBhc3NlcnRpb24gZmFpbHVyZS4gIFdlIG5vdyByZXR1cm4g YSBZWERPTUFJTiByZXNwb25zZSwgd2l0aG91dCB0aGUgYWRkcmVzcy4KCklTQyB3b3VsZCBsaWtl IHRvIHRoYW5rIExhaXRoIE1hc2gnYWwgKDB4bXNoYWwpIGZvciBicmluZ2luZyB0aGlzIGlzc3Vl IHRvIG91ciBhdHRlbnRpb24uCgpDbG9zZXMgaHR0cHM6Ly9naXRsYWIuaXNjLm9yZy9pc2MtcHJv amVjdHMvYmluZDkvLS9pc3N1ZXMvNTg1NgoKLS0tCmRpZmYgLS1naXQgYS9iaW5kLTkuMTgtQ1ZF LTIwMjYtMTEzMzEtdGVzdC5wYXRjaCBiL2JpbmQtOS4xOC1DVkUtMjAyNi0xMTMzMS10ZXN0LnBh dGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjI3YWE2Y2MKLS0tIC9kZXYv bnVsbAorKysgYi9iaW5kLTkuMTgtQ1ZFLTIwMjYtMTEzMzEtdGVzdC5wYXRjaApAQCAtMCwwICsx LDY5IEBACitGcm9tIGNkZThiYjIxZTA5MjA1YTdiZDFmNDFmZDA3ZWQwMTFmYzgwZDhkNzEgTW9u IFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBNYXJrIEFuZHJld3MgPG1hcmthQGlzYy5vcmc+ CitEYXRlOiBGcmksIDEwIEFwciAyMDI2IDEwOjI0OjA2ICsxMDAwCitTdWJqZWN0OiBbUEFUQ0hd IEZpeCBUVEwgZXh0cmFjdGlvbiBmcm9tIEEvQUFBQSByZWNvcmQKKworKGNoZXJyeSBwaWNrZWQg ZnJvbSBjb21taXQgODljODZlMzM4ZGIyNDkyYjkyZTY2MThjNTg2ZjE0NmM2OTI4ZGM2ZCkKKyhj aGVycnkgcGlja2VkIGZyb20gY29tbWl0IGFkYzgyODVkMjNlMmVhYzZlYzQ2M2Y1ZGJjNWE5NTk2 ZmRkMzZjNjApCisKK0NoZWNrIHJweiBuYW1lIHRvbyBsb25nIHdpbGRjYXJkIENOQU1FIGV4cGFu c2lvbiBoYW5kbGluZworCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCA5MzQ1Mzk0ZTIwOTcw MzFiNTViM2VmMzRjZWFhZGY1YTdlYmJlZWYyKQorKGNoZXJyeSBwaWNrZWQgZnJvbSBjb21taXQg MDk1YjExZjIwZjkxMWY1YjgwNTliZGMzNDliMjU2ZDZjNjRlY2UzMCkKKy0tLQorIGJpbi90ZXN0 cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRiIHwgMiArKworIGJpbi90ZXN0cy9zeXN0ZW0vcnB6L25z NC90bGQ0LmRiIHwgMiArKworIGJpbi90ZXN0cy9zeXN0ZW0vcnB6L3Rlc3RzLnNoICAgIHwgNyAr KysrKy0tCisgMyBmaWxlcyBjaGFuZ2VkLCA5IGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0p CisKK2RpZmYgLS1naXQgYS9iaW4vdGVzdHMvc3lzdGVtL3Jwei9uczIvdGxkMi5kYiBiL2Jpbi90 ZXN0cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRiCitpbmRleCBjNmYyNTU2ZGI1Li5jMDkxZWUyN2I3 IDEwMDY0NAorLS0tIGEvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnMyL3RsZDIuZGIKKysrKyBiL2Jp bi90ZXN0cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRiCitAQCAtMTIzLDMgKzEyMyw1IEBAIGE3LTEJ CUEJMTkyLjE2OC43LjEKKyAKKyBhNy0yCQlBCTE5Mi4xNjguNy4yCisgCQlUWFQJImE3LTIgdGxk MiB0ZXh0IgorKworKyoud2lsZAkJQQkxOTIuMTY4LjkuMQorZGlmZiAtLWdpdCBhL2Jpbi90ZXN0 cy9zeXN0ZW0vcnB6L25zNC90bGQ0LmRiIGIvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnM0L3RsZDQu ZGIKK2luZGV4IGZjYTQxOWM2ZGQuLjhhY2NkNzZiYWYgMTAwNjQ0CistLS0gYS9iaW4vdGVzdHMv c3lzdGVtL3Jwei9uczQvdGxkNC5kYgorKysrIGIvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnM0L3Rs ZDQuZGIKK0BAIC01OSw2ICs1OSw4IEBAIGEzLTYudGxkMglBCTU2LjU2LjU2LjU2CisgCisgYTMt Ny5zdWIxLnRsZDIJQQk1Ny41Ny41Ny41NworIAorKyoud2lsZC5zdWIxLnRsZDIJQQk1Ny41Ny41 Ny41NworKworIGEzLTgudGxkMglBCTU4LjU4LjU4LjU4CisgCisgYTMtOS5zdWI5LnRsZDIJQQk1 OS41OS41OS41OQorZGlmZiAtLWdpdCBhL2Jpbi90ZXN0cy9zeXN0ZW0vcnB6L3Rlc3RzLnNoIGIv YmluL3Rlc3RzL3N5c3RlbS9ycHovdGVzdHMuc2gKK2luZGV4IDg3ZTQxMThjYTMuLjUyOTc0Mzc2 OTQgMTAwNjQ0CistLS0gYS9iaW4vdGVzdHMvc3lzdGVtL3Jwei90ZXN0cy5zaAorKysrIGIvYmlu L3Rlc3RzL3N5c3RlbS9ycHovdGVzdHMuc2gKK0BAIC0zOTEsNyArMzkxLDcgQEAgYWRkcigpIHsK KyAgIGRpZ2NtZCAkMiA+JERJR05NCisgICAjY2thbGl2ZSAiJDIiICJzZXJ2ZXIgY3Jhc2hlZCBi eSAnZGlnICQyJyIgfHwgcmV0dXJuIDEKKyAgIEFERFJfRVNDPSQoZWNobyAiJEFERFIiIHwgc2Vk IC1lICdzL1wuL1xcLi9nJykKKy0gIEFERFJfVFRMPSQoc2VkIC1uIC1lICJzL15bLS5hLXowLTld XHsxLFx9WwkgXSpcKFswLTldKlwpCUlOCUFBKgkke0FERFJfRVNDfVwkL1wxL3AiICRESUdOTSkK KysgIEFERFJfVFRMPSQoc2VkIC1uIC1lICJzL15bLS5hLXowLTldXHsxLFx9WwkgXSpcKFswLTld KlwpWyAJXUlOWyAJXUFBKlsgCV0ke0FERFJfRVNDfVwkL1wxL3AiICRESUdOTSkKKyAgIGlmIHRl c3QgLXogIiRBRERSX1RUTCI7IHRoZW4KKyAgICAgc2V0cmV0ICInZGlnICQyJyB3cm9uZzsgbm8g YWRkcmVzcyAkQUREUiByZWNvcmQgaW4gJERJR05NIgorICAgICByZXR1cm4gMAorQEAgLTUxNiw3 ICs1MTYsMTAgQEAgbm9jaGFuZ2UgVENQIGEzLTkudGxkMiAgICAgICAgICAgICAgICAjIDMzIHRj cC1vbmx5CisgaGVyZSB4LnNlcnZmYWlsIDw8J0VPRicgICAgICAgICAgICAgICAjIDM0IHFuYW1l LXdhaXQtcmVjdXJzZSB5ZXMKKyAgIDs7IHN0YXR1czogU0VSVkZBSUwsIHgKKyBFT0YKKy1hZGRy IDM1LjM1LjM1LjM1ICJ4LnNlcnZmYWlsIEAkbnM1IiAjIDM1IHFuYW1lLXdhaXQtcmVjdXJzZSBu bworK2FkZHIgMzUuMzUuMzUuMzUgInguc2VydmZhaWwgQCRuczUiICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyAzNSBxbmFtZS13YWl0LXJl Y3Vyc2Ugbm8KKytoZXJlIGFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhLmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYS5hYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWEuYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWFhYS53aWxkLnN1YjEudGxkMiA8PCdFT0YnICMgMzYgd2lsZGNh cmQgQ05BTUUgbmFtZSB0byBsb25nCisrICAgIDs7IHN0YXR1czogWVhET01BSU4sIHgKKytFT0YK KyBlbmRfZ3JvdXAKKyBja3N0YXRzICRuczMgdGVzdDEgbnMzIDIyCisgY2tzdGF0cyAkbnM1IHRl c3QxIG5zNSAxCistLSAKKzIuNTUuMAorCgpkaWZmIC0tZ2l0IGEvYmluZC05LjE4LUNWRS0yMDI2 LTExMzMxLnBhdGNoIGIvYmluZC05LjE4LUNWRS0yMDI2LTExMzMxLnBhdGNoCm5ldyBmaWxlIG1v ZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjhiYWE5OGMKLS0tIC9kZXYvbnVsbAorKysgYi9iaW5k LTkuMTgtQ1ZFLTIwMjYtMTEzMzEucGF0Y2gKQEAgLTAsMCArMSwzMSBAQAorRnJvbSA0OWY0Y2M0 ZTkzZjE0ZjFkNWI2YTQ3MjEyNGU2YWE0NTcxNjdmZWRlIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAw MQorRnJvbTogTWFyayBBbmRyZXdzIDxtYXJrYUBpc2Mub3JnPgorRGF0ZTogRnJpLCAxMCBBcHIg MjAyNiAxMDoyNjoxNCArMTAwMAorU3ViamVjdDogW1BBVENIXSBQcm9wZXJseSBoYW5kbGUgcnB6 IG5hbWUgdG8gbG9uZyB3aWxkY2FyZCBleHBhbnNpb24KKworUHJldmlvdXNseSBhIHNlbGYgcmVm ZXJlbnRpYWwgQ05BTUUgYW5kIHRoZSBvcmlnaW5hbCBhZGRyZXNzCityZWNvcmQgd2VyZSByZXR1 cm5lZC4gIFdlIG5vdyByZXR1cm4gYSBZWERPTUFJTiByZXNwb25zZS4KKworKGNoZXJyeSBwaWNr ZWQgZnJvbSBjb21taXQgY2ZjNGM0ZjY5ODcwY2U0OTJkZWFhYTQyOTQ1MzU2M2QxNjIxZGVkMykK KyhjaGVycnkgcGlja2VkIGZyb20gY29tbWl0IGRjMzI4YTE5OWY5NjIyMmUwYzMwY2MyMGI3Yjc5 NWJmYzJjOWIyZTQpCistLS0KKyBsaWIvbnMvcXVlcnkuYyB8IDMgKystCisgMSBmaWxlIGNoYW5n ZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQorCitkaWZmIC0tZ2l0IGEvbGliL25z L3F1ZXJ5LmMgYi9saWIvbnMvcXVlcnkuYworaW5kZXggZDNhMTBiZTliYS4uM2JkN2RhZjc5YyAx MDA2NDQKKy0tLSBhL2xpYi9ucy9xdWVyeS5jCisrKysgYi9saWIvbnMvcXVlcnkuYworQEAgLTc1 OTEsNyArNzU5MSw4IEBAIHF1ZXJ5X3JwemNuYW1lKHF1ZXJ5X2N0eF90ICpxY3R4LCBkbnNfbmFt ZV90ICpjbmFtZSkgeworIAkJCQkJICAgICAgcWN0eC0+Zm5hbWUsIE5VTEwpOworIAkJaWYgKHJl c3VsdCA9PSBETlNfUl9OQU1FVE9PTE9ORykgeworIAkJCWNsaWVudC0+bWVzc2FnZS0+cmNvZGUg PSBkbnNfcmNvZGVfeXhkb21haW47CistCQl9IGVsc2UgaWYgKHJlc3VsdCAhPSBJU0NfUl9TVUND RVNTKSB7CisrCQl9CisrCQlpZiAocmVzdWx0ICE9IElTQ19SX1NVQ0NFU1MpIHsKKyAJCQlyZXR1 cm4gcmVzdWx0OworIAkJfQorIAl9IGVsc2UgeworLS0gCisyLjU1LjAKKwoKZGlmZiAtLWdpdCBh L2JpbmQuc3BlYyBiL2JpbmQuc3BlYwppbmRleCBhMjliYWQ4Li5iYmU2NzdkIDEwMDY0NAotLS0g YS9iaW5kLnNwZWMKKysrIGIvYmluZC5zcGVjCkBAIC0xNjAsNiArMTYwLDEwIEBAIFBhdGNoMzM6 IGJpbmQtOS4xOC1kaWctaWRuLWlucHV0LWFsd2F5cy5wYXRjaAogUGF0Y2gzNDogYmluZC05LjE4 LWRpZy1pZG4taW5wdXQtYWx3YXlzLXRlc3QucGF0Y2gKICMgZG93bnN0cmVhbSBvbmx5LCBodHRw czovL3JlZGhhdC5hdGxhc3NpYW4ubmV0L2Jyb3dzZS9JRE0tNjE4OQogUGF0Y2gzNTogMDAwMS1V c2UtdmFyaWFibGUtUFJPR1JBTV9TVUZGSVgtaW4taW5zdGFsbC10YXJnZXQucGF0Y2gKKyMgaHR0 cHM6Ly9naXRsYWIuaXNjLm9yZy9pc2MtcHJvamVjdHMvYmluZDkvY29tbWl0LzRmZDA3NTViZGQw ODQ3MWY3NGU2ZTRjNzZjZDIzMjZmMzU2ZTBhNjEKKyMgaHR0cHM6Ly9naXRsYWIuaXNjLm9yZy9p c2MtcHJvamVjdHMvYmluZDkvLS93b3JrX2l0ZW1zLzU4NTYKK1BhdGNoMzY6IGJpbmQtOS4xOC1D VkUtMjAyNi0xMTMzMS5wYXRjaAorUGF0Y2gzNzogYmluZC05LjE4LUNWRS0yMDI2LTExMzMxLXRl c3QucGF0Y2gKIAogJXs/c3lzdGVtZF9vcmRlcmluZ30KICMgaHR0cHM6Ly9mZWRvcmFwcm9qZWN0 Lm9yZy93aWtpL0NoYW5nZXMvUlBNU3Vwb3J0Rm9yU3lzdGVtZFN5c3VzZXJzCg==