From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 From: =?utf-8?b?UGV0ciBNZW7FocOtayA8cGVtZW5zaWtAcmVkaGF0LmNvbT4=?= To: git-commits@fedoraproject.org Subject: [rpms/bind] f43: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) Date: Wed, 26 Aug 2026 09:29:13 GMT Message-ID: <178773655329.1.6204348472968727594.rpms-bind-45353df914ea@fedoraproject.org> List-ID: X-Git-Repo: rpms/bind X-Git-Branch: f43 X-Git-Rev: 45353df914ea344229b98a26a80ba8186c5e693b ICAgICAgICAgICAgQSBuZXcgY29tbWl0IGhhcyBiZWVuIHB1c2hlZC4KCiAgICAgICAgICAgIFJl cG8gICA6IHJwbXMvYmluZAogICAgICAgICAgICBCcmFuY2ggOiBmNDMKICAgICAgICAgICAgQ29t bWl0IDogNDUzNTNkZjkxNGVhMzQ0MjI5Yjk4YTI2YTgwYmE4MTg2YzVlNjkzYgogICAgICAgICAg ICBBdXRob3IgOiBQZXRyIE1lbsWhw61rIDxwZW1lbnNpa0ByZWRoYXQuY29tPgogICAgICAgICAg ICBEYXRlICAgOiAyMDI2LTA4LTI2VDExOjA3OjQ5KzAyOjAwCiAgICAgICAgICAgIFN0YXRzICA6 ICsxMDgvLTEgaW4gMyBmaWxlKHMpCiAgICAgICAgICAgIFVSTCAgICA6IGh0dHBzOi8vc3JjLmZl ZG9yYXByb2plY3Qub3JnL3JwbXMvYmluZC9jLzQ1MzUzZGY5MTRlYTM0NDIyOWI5OGEyNmE4MGJh ODE4NmM1ZTY5M2I/YnJhbmNoPWY0MwoKICAgICAgICAgICAgTG9nOgogICAgICAgICAgICBQb3Rl bnRpYWwgd2lsZGNhcmQgQ05BTUUgUlBaIHBvbGljeSBieXBhc3MgKENWRS0yMDI2LTExMzMxKQoK WzkuMThdIFtDVkUtMjAyNi0xMTMzMV0gc2VjOiB1c3I6IEZpeCBoYW5kbGluZyBvZiBycHogQ05B TUUgZXhwYW5zaW9uIHRoYXQgcmV0dXJucyBuYW1lIHRvbyBsb25nCgpQcmV2aW91c2x5LCBpZiB0 aGUgZXhwYW5zaW9uIG9mIGEgd2lsZGNhcmQgQ05BTUUgUlBaIHBvbGljeSByZXN1bHRlZCBpbiBh IG5hbWUgdGhhdCBleGNlZWRlZCB0aGUgbGVuZ3RoIGxpbWl0LCBhIHNlbGYgcmVmZXJlbnRpYWwg Q05BTUUgYW5kIHRoZSBvcmlnaW5hbCBhZGRyZXNzIHJlY29yZCB3ZXJlIHJldHVybmVkLCBhbGxv d2luZyB0aGUgcG9saWN5IHRvIGJlIGJ5cGFzc2VkLiAgSW4gYnJhbmNoZXMgdXAgdG8gOS4yMCwg dGhpcyBhbHNvIGxlZnQgcXVlcnkgcHJvY2Vzc2luZyBpbiBhbiBpbmNvbnNpc3RlbnQgc3RhdGUg d2hpY2ggY291bGQgdHJpZ2dlciBhbiBhc3NlcnRpb24gZmFpbHVyZS4gIFdlIG5vdyByZXR1cm4g YSBZWERPTUFJTiByZXNwb25zZSwgd2l0aG91dCB0aGUgYWRkcmVzcy4KCklTQyB3b3VsZCBsaWtl IHRvIHRoYW5rIExhaXRoIE1hc2gnYWwgKDB4bXNoYWwpIGZvciBicmluZ2luZyB0aGlzIGlzc3Vl IHRvIG91ciBhdHRlbnRpb24uCgpDbG9zZXMgaHR0cHM6Ly9naXRsYWIuaXNjLm9yZy9pc2MtcHJv amVjdHMvYmluZDkvLS9pc3N1ZXMvNTg1NgoKLS0tCmRpZmYgLS1naXQgYS9iaW5kLTkuMTgtQ1ZF LTIwMjYtMTEzMzEtdGVzdC5wYXRjaCBiL2JpbmQtOS4xOC1DVkUtMjAyNi0xMTMzMS10ZXN0LnBh dGNoCm5ldyBmaWxlIG1vZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjI3YWE2Y2MKLS0tIC9kZXYv bnVsbAorKysgYi9iaW5kLTkuMTgtQ1ZFLTIwMjYtMTEzMzEtdGVzdC5wYXRjaApAQCAtMCwwICsx LDY5IEBACitGcm9tIGNkZThiYjIxZTA5MjA1YTdiZDFmNDFmZDA3ZWQwMTFmYzgwZDhkNzEgTW9u IFNlcCAxNyAwMDowMDowMCAyMDAxCitGcm9tOiBNYXJrIEFuZHJld3MgPG1hcmthQGlzYy5vcmc+ CitEYXRlOiBGcmksIDEwIEFwciAyMDI2IDEwOjI0OjA2ICsxMDAwCitTdWJqZWN0OiBbUEFUQ0hd IEZpeCBUVEwgZXh0cmFjdGlvbiBmcm9tIEEvQUFBQSByZWNvcmQKKworKGNoZXJyeSBwaWNrZWQg ZnJvbSBjb21taXQgODljODZlMzM4ZGIyNDkyYjkyZTY2MThjNTg2ZjE0NmM2OTI4ZGM2ZCkKKyhj aGVycnkgcGlja2VkIGZyb20gY29tbWl0IGFkYzgyODVkMjNlMmVhYzZlYzQ2M2Y1ZGJjNWE5NTk2 ZmRkMzZjNjApCisKK0NoZWNrIHJweiBuYW1lIHRvbyBsb25nIHdpbGRjYXJkIENOQU1FIGV4cGFu c2lvbiBoYW5kbGluZworCisoY2hlcnJ5IHBpY2tlZCBmcm9tIGNvbW1pdCA5MzQ1Mzk0ZTIwOTcw MzFiNTViM2VmMzRjZWFhZGY1YTdlYmJlZWYyKQorKGNoZXJyeSBwaWNrZWQgZnJvbSBjb21taXQg MDk1YjExZjIwZjkxMWY1YjgwNTliZGMzNDliMjU2ZDZjNjRlY2UzMCkKKy0tLQorIGJpbi90ZXN0 cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRiIHwgMiArKworIGJpbi90ZXN0cy9zeXN0ZW0vcnB6L25z NC90bGQ0LmRiIHwgMiArKworIGJpbi90ZXN0cy9zeXN0ZW0vcnB6L3Rlc3RzLnNoICAgIHwgNyAr KysrKy0tCisgMyBmaWxlcyBjaGFuZ2VkLCA5IGluc2VydGlvbnMoKyksIDIgZGVsZXRpb25zKC0p CisKK2RpZmYgLS1naXQgYS9iaW4vdGVzdHMvc3lzdGVtL3Jwei9uczIvdGxkMi5kYiBiL2Jpbi90 ZXN0cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRiCitpbmRleCBjNmYyNTU2ZGI1Li5jMDkxZWUyN2I3 IDEwMDY0NAorLS0tIGEvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnMyL3RsZDIuZGIKKysrKyBiL2Jp bi90ZXN0cy9zeXN0ZW0vcnB6L25zMi90bGQyLmRiCitAQCAtMTIzLDMgKzEyMyw1IEBAIGE3LTEJ CUEJMTkyLjE2OC43LjEKKyAKKyBhNy0yCQlBCTE5Mi4xNjguNy4yCisgCQlUWFQJImE3LTIgdGxk MiB0ZXh0IgorKworKyoud2lsZAkJQQkxOTIuMTY4LjkuMQorZGlmZiAtLWdpdCBhL2Jpbi90ZXN0 cy9zeXN0ZW0vcnB6L25zNC90bGQ0LmRiIGIvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnM0L3RsZDQu ZGIKK2luZGV4IGZjYTQxOWM2ZGQuLjhhY2NkNzZiYWYgMTAwNjQ0CistLS0gYS9iaW4vdGVzdHMv c3lzdGVtL3Jwei9uczQvdGxkNC5kYgorKysrIGIvYmluL3Rlc3RzL3N5c3RlbS9ycHovbnM0L3Rs ZDQuZGIKK0BAIC01OSw2ICs1OSw4IEBAIGEzLTYudGxkMglBCTU2LjU2LjU2LjU2CisgCisgYTMt Ny5zdWIxLnRsZDIJQQk1Ny41Ny41Ny41NworIAorKyoud2lsZC5zdWIxLnRsZDIJQQk1Ny41Ny41 Ny41NworKworIGEzLTgudGxkMglBCTU4LjU4LjU4LjU4CisgCisgYTMtOS5zdWI5LnRsZDIJQQk1 OS41OS41OS41OQorZGlmZiAtLWdpdCBhL2Jpbi90ZXN0cy9zeXN0ZW0vcnB6L3Rlc3RzLnNoIGIv YmluL3Rlc3RzL3N5c3RlbS9ycHovdGVzdHMuc2gKK2luZGV4IDg3ZTQxMThjYTMuLjUyOTc0Mzc2 OTQgMTAwNjQ0CistLS0gYS9iaW4vdGVzdHMvc3lzdGVtL3Jwei90ZXN0cy5zaAorKysrIGIvYmlu L3Rlc3RzL3N5c3RlbS9ycHovdGVzdHMuc2gKK0BAIC0zOTEsNyArMzkxLDcgQEAgYWRkcigpIHsK KyAgIGRpZ2NtZCAkMiA+JERJR05NCisgICAjY2thbGl2ZSAiJDIiICJzZXJ2ZXIgY3Jhc2hlZCBi eSAnZGlnICQyJyIgfHwgcmV0dXJuIDEKKyAgIEFERFJfRVNDPSQoZWNobyAiJEFERFIiIHwgc2Vk IC1lICdzL1wuL1xcLi9nJykKKy0gIEFERFJfVFRMPSQoc2VkIC1uIC1lICJzL15bLS5hLXowLTld XHsxLFx9WwkgXSpcKFswLTldKlwpCUlOCUFBKgkke0FERFJfRVNDfVwkL1wxL3AiICRESUdOTSkK KysgIEFERFJfVFRMPSQoc2VkIC1uIC1lICJzL15bLS5hLXowLTldXHsxLFx9WwkgXSpcKFswLTld KlwpWyAJXUlOWyAJXUFBKlsgCV0ke0FERFJfRVNDfVwkL1wxL3AiICRESUdOTSkKKyAgIGlmIHRl c3QgLXogIiRBRERSX1RUTCI7IHRoZW4KKyAgICAgc2V0cmV0ICInZGlnICQyJyB3cm9uZzsgbm8g YWRkcmVzcyAkQUREUiByZWNvcmQgaW4gJERJR05NIgorICAgICByZXR1cm4gMAorQEAgLTUxNiw3 ICs1MTYsMTAgQEAgbm9jaGFuZ2UgVENQIGEzLTkudGxkMiAgICAgICAgICAgICAgICAjIDMzIHRj cC1vbmx5CisgaGVyZSB4LnNlcnZmYWlsIDw8J0VPRicgICAgICAgICAgICAgICAjIDM0IHFuYW1l LXdhaXQtcmVjdXJzZSB5ZXMKKyAgIDs7IHN0YXR1czogU0VSVkZBSUwsIHgKKyBFT0YKKy1hZGRy IDM1LjM1LjM1LjM1ICJ4LnNlcnZmYWlsIEAkbnM1IiAjIDM1IHFuYW1lLXdhaXQtcmVjdXJzZSBu bworK2FkZHIgMzUuMzUuMzUuMzUgInguc2VydmZhaWwgQCRuczUiICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIyAzNSBxbmFtZS13YWl0LXJl Y3Vyc2Ugbm8KKytoZXJlIGFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhLmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYS5hYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWEuYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFh YWFhYWFhYWFhYWFhYWFhYWFhYWFhYS53aWxkLnN1YjEudGxkMiA8PCdFT0YnICMgMzYgd2lsZGNh cmQgQ05BTUUgbmFtZSB0byBsb25nCisrICAgIDs7IHN0YXR1czogWVhET01BSU4sIHgKKytFT0YK KyBlbmRfZ3JvdXAKKyBja3N0YXRzICRuczMgdGVzdDEgbnMzIDIyCisgY2tzdGF0cyAkbnM1IHRl c3QxIG5zNSAxCistLSAKKzIuNTUuMAorCgpkaWZmIC0tZ2l0IGEvYmluZC05LjE4LUNWRS0yMDI2 LTExMzMxLnBhdGNoIGIvYmluZC05LjE4LUNWRS0yMDI2LTExMzMxLnBhdGNoCm5ldyBmaWxlIG1v ZGUgMTAwNjQ0CmluZGV4IDAwMDAwMDAuLjhiYWE5OGMKLS0tIC9kZXYvbnVsbAorKysgYi9iaW5k LTkuMTgtQ1ZFLTIwMjYtMTEzMzEucGF0Y2gKQEAgLTAsMCArMSwzMSBAQAorRnJvbSA0OWY0Y2M0 ZTkzZjE0ZjFkNWI2YTQ3MjEyNGU2YWE0NTcxNjdmZWRlIE1vbiBTZXAgMTcgMDA6MDA6MDAgMjAw MQorRnJvbTogTWFyayBBbmRyZXdzIDxtYXJrYUBpc2Mub3JnPgorRGF0ZTogRnJpLCAxMCBBcHIg MjAyNiAxMDoyNjoxNCArMTAwMAorU3ViamVjdDogW1BBVENIXSBQcm9wZXJseSBoYW5kbGUgcnB6 IG5hbWUgdG8gbG9uZyB3aWxkY2FyZCBleHBhbnNpb24KKworUHJldmlvdXNseSBhIHNlbGYgcmVm ZXJlbnRpYWwgQ05BTUUgYW5kIHRoZSBvcmlnaW5hbCBhZGRyZXNzCityZWNvcmQgd2VyZSByZXR1 cm5lZC4gIFdlIG5vdyByZXR1cm4gYSBZWERPTUFJTiByZXNwb25zZS4KKworKGNoZXJyeSBwaWNr ZWQgZnJvbSBjb21taXQgY2ZjNGM0ZjY5ODcwY2U0OTJkZWFhYTQyOTQ1MzU2M2QxNjIxZGVkMykK KyhjaGVycnkgcGlja2VkIGZyb20gY29tbWl0IGRjMzI4YTE5OWY5NjIyMmUwYzMwY2MyMGI3Yjc5 NWJmYzJjOWIyZTQpCistLS0KKyBsaWIvbnMvcXVlcnkuYyB8IDMgKystCisgMSBmaWxlIGNoYW5n ZWQsIDIgaW5zZXJ0aW9ucygrKSwgMSBkZWxldGlvbigtKQorCitkaWZmIC0tZ2l0IGEvbGliL25z L3F1ZXJ5LmMgYi9saWIvbnMvcXVlcnkuYworaW5kZXggZDNhMTBiZTliYS4uM2JkN2RhZjc5YyAx MDA2NDQKKy0tLSBhL2xpYi9ucy9xdWVyeS5jCisrKysgYi9saWIvbnMvcXVlcnkuYworQEAgLTc1 OTEsNyArNzU5MSw4IEBAIHF1ZXJ5X3JwemNuYW1lKHF1ZXJ5X2N0eF90ICpxY3R4LCBkbnNfbmFt ZV90ICpjbmFtZSkgeworIAkJCQkJICAgICAgcWN0eC0+Zm5hbWUsIE5VTEwpOworIAkJaWYgKHJl c3VsdCA9PSBETlNfUl9OQU1FVE9PTE9ORykgeworIAkJCWNsaWVudC0+bWVzc2FnZS0+cmNvZGUg PSBkbnNfcmNvZGVfeXhkb21haW47CistCQl9IGVsc2UgaWYgKHJlc3VsdCAhPSBJU0NfUl9TVUND RVNTKSB7CisrCQl9CisrCQlpZiAocmVzdWx0ICE9IElTQ19SX1NVQ0NFU1MpIHsKKyAJCQlyZXR1 cm4gcmVzdWx0OworIAkJfQorIAl9IGVsc2UgeworLS0gCisyLjU1LjAKKwoKZGlmZiAtLWdpdCBh L2JpbmQuc3BlYyBiL2JpbmQuc3BlYwppbmRleCBmNWRjZTYwLi44NTNkOWJhIDEwMDY0NAotLS0g YS9iaW5kLnNwZWMKKysrIGIvYmluZC5zcGVjCkBAIC04OCw3ICs4OCw3IEBAIExpY2Vuc2U6ICBN UEwtMi4wIEFORCBJU0MgQU5EIE1JVCBBTkQgQlNELTMtQ2xhdXNlIEFORCBCU0QtMi1DbGF1c2UK ICMgQmVmb3JlIHJlYmFzaW5nIGJpbmQsIGVuc3VyZSBiaW5kLWR5bmRiLWxkYXAgaXMgcmVhZHkg dG8gYmUgcmVidWlsZCBhbmQgdXNlIHNpZGUtdGFnIHdpdGggaXQuCiAjIFVwZGF0aW5nIGp1c3Qg YmluZCB3aWxsIGNhdXNlIGZyZWVpcGEtZG5zLXNlcnZlciBwYWNrYWdlIHRvIGJlIHVuaW5zdGFs bGFibGUuCiBWZXJzaW9uOiAgOS4xOC41MAotUmVsZWFzZTogIDElez9kaXN0fQorUmVsZWFzZTog IDIlez9kaXN0fQogRXBvY2g6ICAgIDMyCiBVcmw6ICAgICAgaHR0cHM6Ly93d3cuaXNjLm9yZy9k b3dubG9hZHMvYmluZC8KICMKQEAgLTE0NCw2ICsxNDQsMTAgQEAgUGF0Y2gzMjogYmluZC05LjE4 LXBhcnRpYWwtYWRkaXRpb25hbC1yZWNvcmRzLnBhdGNoCiBQYXRjaDMzOiBiaW5kLTkuMTgtZGln LWlkbi1pbnB1dC1hbHdheXMucGF0Y2gKICMgZG93bnN0cmVhbSBvbmx5IHRvbwogUGF0Y2gzNDog YmluZC05LjE4LWRpZy1pZG4taW5wdXQtYWx3YXlzLXRlc3QucGF0Y2gKKyMgaHR0cHM6Ly9naXRs YWIuaXNjLm9yZy9pc2MtcHJvamVjdHMvYmluZDkvY29tbWl0LzRmZDA3NTViZGQwODQ3MWY3NGU2 ZTRjNzZjZDIzMjZmMzU2ZTBhNjEKKyMgaHR0cHM6Ly9naXRsYWIuaXNjLm9yZy9pc2MtcHJvamVj dHMvYmluZDkvLS93b3JrX2l0ZW1zLzU4NTYKK1BhdGNoMzY6IGJpbmQtOS4xOC1DVkUtMjAyNi0x MTMzMS5wYXRjaAorUGF0Y2gzNzogYmluZC05LjE4LUNWRS0yMDI2LTExMzMxLXRlc3QucGF0Y2gK IAogJXs/c3lzdGVtZF9vcmRlcmluZ30KICMgaHR0cHM6Ly9mZWRvcmFwcm9qZWN0Lm9yZy93aWtp L0NoYW5nZXMvUlBNU3Vwb3J0Rm9yU3lzdGVtZFN5c3VzZXJzCkBAIC05NDQsNiArOTQ4LDkgQEAg Zmk7CiAlZW5kaWYKIAogJWNoYW5nZWxvZworKiBUdWUgQXVnIDI1IDIwMjYgUGV0ciBNZW7FocOt ayA8cGVtZW5zaWtAcmVkaGF0LmNvbT4gLSAzMjo5LjE4LjUwLTIKKy0gUG90ZW50aWFsIHdpbGRj YXJkIENOQU1FIFJQWiBwb2xpY3kgYnlwYXNzIChDVkUtMjAyNi0xMTMzMSkKKwogKiBXZWQgSnVu IDE3IDIwMjYgUGV0ciBNZW7FocOtayA8cGVtZW5zaWtAcmVkaGF0LmNvbT4gLSAzMjo5LjE4LjUw LTEKIC0gVXBkYXRlIHRvIDkuMTguNTAgKHJoYnojMjQ4OTgzMykKIC0gUmVtb3ZlIHJ3dGFiIGZp bGVzCg==