diff options
author | Lee Chee Yang <chee.yang.lee@intel.com> | 2020-05-27 17:56:38 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-06-02 13:32:50 +0100 |
commit | fb2a7918923d01f69dd2fe4f7c223eaecb14af3e (patch) | |
tree | 36c33aa84df943d10cfd219efa4643fd287c336b /meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch | |
parent | 657d14a41ff89d735e0f5e8e7e418c66943f0ff1 (diff) | |
download | poky-fb2a7918923d01f69dd2fe4f7c223eaecb14af3e.tar.gz |
bind: fix CVE-2020-8616/7
fix CVE-2020-8616 and CVE-2020-8617
(From OE-Core rev: b280b3fe22a1fda62707bfa40ca78439ad201736)
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Anuj Mittal <anuj.mittal@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch')
-rw-r--r-- | meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch b/meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch new file mode 100644 index 0000000000..d8769c45cc --- /dev/null +++ b/meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch | |||
@@ -0,0 +1,29 @@ | |||
1 | Upstream-Status: Backport [https://downloads.isc.org/isc/bind9/9.11.19/patches/CVE-2020-8617.patch] | ||
2 | CVE: CVE-2020-8617 | ||
3 | Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> | ||
4 | --- | ||
5 | diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c | ||
6 | index b597a18d49..6357a3a486 100644 | ||
7 | --- a/lib/dns/tsig.c | ||
8 | +++ b/lib/dns/tsig.c | ||
9 | @@ -1427,8 +1424,9 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg, | ||
10 | goto cleanup_context; | ||
11 | } | ||
12 | msg->verified_sig = 1; | ||
13 | - } else if (tsig.error != dns_tsigerror_badsig && | ||
14 | - tsig.error != dns_tsigerror_badkey) { | ||
15 | + } else if (!response || (tsig.error != dns_tsigerror_badsig && | ||
16 | + tsig.error != dns_tsigerror_badkey)) | ||
17 | + { | ||
18 | tsig_log(msg->tsigkey, 2, "signature was empty"); | ||
19 | return (DNS_R_TSIGVERIFYFAILURE); | ||
20 | } | ||
21 | @@ -1484,7 +1482,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg, | ||
22 | } | ||
23 | } | ||
24 | |||
25 | - if (tsig.error != dns_rcode_noerror) { | ||
26 | + if (response && tsig.error != dns_rcode_noerror) { | ||
27 | msg->tsigstatus = tsig.error; | ||
28 | if (tsig.error == dns_tsigerror_badtime) | ||
29 | ret = DNS_R_CLOCKSKEW; | ||