diff options
Diffstat (limited to 'meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch')
-rw-r--r-- | meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch | 29 |
1 files changed, 29 insertions, 0 deletions
diff --git a/meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch b/meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch new file mode 100644 index 0000000000..d8769c45cc --- /dev/null +++ b/meta/recipes-connectivity/bind/bind/CVE-2020-8617.patch | |||
@@ -0,0 +1,29 @@ | |||
1 | Upstream-Status: Backport [https://downloads.isc.org/isc/bind9/9.11.19/patches/CVE-2020-8617.patch] | ||
2 | CVE: CVE-2020-8617 | ||
3 | Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> | ||
4 | --- | ||
5 | diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c | ||
6 | index b597a18d49..6357a3a486 100644 | ||
7 | --- a/lib/dns/tsig.c | ||
8 | +++ b/lib/dns/tsig.c | ||
9 | @@ -1427,8 +1424,9 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg, | ||
10 | goto cleanup_context; | ||
11 | } | ||
12 | msg->verified_sig = 1; | ||
13 | - } else if (tsig.error != dns_tsigerror_badsig && | ||
14 | - tsig.error != dns_tsigerror_badkey) { | ||
15 | + } else if (!response || (tsig.error != dns_tsigerror_badsig && | ||
16 | + tsig.error != dns_tsigerror_badkey)) | ||
17 | + { | ||
18 | tsig_log(msg->tsigkey, 2, "signature was empty"); | ||
19 | return (DNS_R_TSIGVERIFYFAILURE); | ||
20 | } | ||
21 | @@ -1484,7 +1482,7 @@ dns_tsig_verify(isc_buffer_t *source, dns_message_t *msg, | ||
22 | } | ||
23 | } | ||
24 | |||
25 | - if (tsig.error != dns_rcode_noerror) { | ||
26 | + if (response && tsig.error != dns_rcode_noerror) { | ||
27 | msg->tsigstatus = tsig.error; | ||
28 | if (tsig.error == dns_tsigerror_badtime) | ||
29 | ret = DNS_R_CLOCKSKEW; | ||