diff mbox series

[meta-networking,wrynose,20/32] unbound: patch CVE-2026-50243

Message ID 20260910230932.173913-20-ankur.tyagi85@gmail.com
State Under Review
Delegated to: Anuj Mittal
Headers show
Series [meta-oe,wrynose,1/32] zabbix: ignore multiple CVEs | expand

Commit Message

Ankur Tyagi Sept. 10, 2026, 11:09 p.m. UTC 
From: Ankur Tyagi <ankur.tyagi85@gmail.com>

Details:
https://nvd.nist.gov/vuln/detail/cve-2026-50243

Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
---
 .../unbound/unbound/CVE-2026-50243.patch      | 36 +++++++++++++++++++
 .../recipes-support/unbound/unbound_1.24.2.bb |  1 +
 2 files changed, 37 insertions(+)
 create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-50243.patch
diff mbox series

Patch

diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-50243.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-50243.patch
new file mode 100644
index 0000000000..761bc9687a
--- /dev/null
+++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-50243.patch
@@ -0,0 +1,36 @@ 
+From 793f66cb3c63357bd610690151a4859b159f7f5e Mon Sep 17 00:00:00 2001
+From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
+Date: Wed, 22 Jul 2026 10:14:04 +0200
+Subject: [PATCH] - Fix CVE-2026-50243, 'response-ip'/'rpz' can rewrite BOGUS
+ answers   instead of returning SERVFAIL. Thanks to Qifan Zhang, Palo Alto  
+ Networks, for the report.
+
+(cherry picked from commit 02b16de1ae40e43a3e3804e98ab9868da33d72eb)
+
+CVE: CVE-2026-50243
+Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/02b16de1ae40e43a3e3804e98ab9868da33d72eb]
+
+Signed-off-by: Ankur Tyagi <ankur.tyagi85@gmail.com>
+---
+ respip/respip.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+diff --git a/respip/respip.c b/respip/respip.c
+index 353a0fd78..346f84feb 100644
+--- a/respip/respip.c
++++ b/respip/respip.c
+@@ -1110,7 +1110,13 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
+ 		if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
+ 			qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
+ 			qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
+-			qstate->return_msg && qstate->return_msg->rep) {
++			qstate->return_msg && qstate->return_msg->rep &&
++			!(qstate->env->need_to_validate &&
++			  (!(qstate->query_flags & BIT_CD)
++			    || qstate->env->cfg->ignore_cd) &&
++			  (qstate->return_msg->rep->security <= sec_status_bogus
++			    || qstate->return_msg->rep->security ==
++			    sec_status_secure_sentinel_fail))) {
+ 			struct reply_info* new_rep = qstate->return_msg->rep;
+ 			struct ub_packed_rrset_key* alias_rrset = NULL;
+ 			struct respip_action_info actinfo = {0, 0, 0, 0, NULL, 0, NULL};
diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
index cc380f6ae0..68d81fc551 100644
--- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
+++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb
@@ -30,6 +30,7 @@  SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t
            file://CVE-2026-44687.patch \
            file://CVE-2026-50045.patch \
            file://CVE-2026-50046.patch \
+           file://CVE-2026-50243.patch \
            "
 
 SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"