fix(cve): CVE-2026-13204 - dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3

debian/changelog

@@ -1,3 +1,57 @@
+bind9 (1:9.20.23-1~deb13u1deepin10) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-11721
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 13:43:09 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin9) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-10723
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 13:19:22 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin8) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-10822
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 10:18:02 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin7) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-11331
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 10:10:36 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin6) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-11605
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 10:05:17 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin5) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-13321
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 09:52:54 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin4) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-11622
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 09:43:15 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin3) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-12617
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 09:37:32 +0800
+
+bind9 (1:9.20.23-1~deb13u1deepin2) unstable; urgency=medium
+
+  * fix(cve): CVE-2026-13204
+
+ -- deepin-ci-robot <packages@deepin.org>  Fri, 24 Jul 2026 09:26:55 +0800
+
 bind9 (1:9.20.23-1~deb13u1deepin1) unstable; urgency=medium
 
   [ lichenggang ]

debian/patches/CVE-2026-10723.patch

@@ -0,0 +1,51 @@
+Description: CVE-2026-10723 - 安全修复
+Author: Evan Hunt <each@isc.org>
+Origin: https://gitlab.isc.org/isc-projects/bind9/commit/6965fa47edd3b45538db2b16488dbb6b4ad8066a
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-10723
+Last-Update: Wed Jul 1 23:24:09 2026 -0700
+---
+diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
+index cf95f53622..3bd7069e8a 100644
+--- a/lib/dns/dnssec.c
++++ b/lib/dns/dnssec.c
+@@ -402,10 +402,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
+ 	}
+
+ 	/*
+-	 * NS, SOA and DNSKEY records are signed by their owner.
+-	 * DS records are signed by the parent.
++	 * NS, SOA and DNSKEY records are signed by their owners.
++	 * NSEC3 records are signed by the apex, exactly one level up
++	 * from their owner names.
++	 * DS records are signed by the parent zone.
+ 	 */
+ 	switch (set->type) {
++	case dns_rdatatype_nsec3: {
++		dns_name_t apex = DNS_NAME_INITEMPTY;
++		labels = dns_name_countlabels(name);
++		if (labels <= 1) {
++			inc_stat(dns_dnssecstats_fail);
++			return DNS_R_INVALIDNSEC3;
++		}
++		dns_name_split(name, labels - 1, NULL, &apex);
++		if (!dns_name_equal(&apex, &sig.signer)) {
++			inc_stat(dns_dnssecstats_fail);
++			return DNS_R_SIGINVALID;
++		}
++	} break;
+ 	case dns_rdatatype_ns:
+ 	case dns_rdatatype_soa:
+ 	case dns_rdatatype_dnskey:
+diff --git a/lib/isc/result.c b/lib/isc/result.c
+index 29b8bc65f4..3bce804809 100644
+--- a/lib/isc/result.c
++++ b/lib/isc/result.c
+@@ -200,7 +200,7 @@ static const char *description[ISC_R_NRESULTS] = {
+ 	[DNS_R_COVERINGNSEC] = "covering NSEC record returned",
+ 	[DNS_R_MXISADDRESS] = "MX is an address",
+ 	[DNS_R_DUPLICATE] = "duplicate query",
+-	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)",
++	[DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name",
+ 	[DNS_R_NOTPRIMARY] = "not primary",
+ 	[DNS_R_BROKENCHAIN] = "broken trust chain",
+ 	[DNS_R_EXPIRED] = "expired",

debian/patches/CVE-2026-10822.patch

@@ -0,0 +1,156 @@
+Description: CVE-2026-10822 - 安全修复
+Author: Mark Andrews <marka@isc.org>
+Origin: https://github.com/isc-projects/bind9/commit/9a82af76e8b7249f512dd50a9a7925270475a22f
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-10822
+Last-Update: 2026-07-10 09:33:40 +0200
+---
+diff --git a/bin/tests/system/xfer/ans9/ans.py b/bin/tests/system/xfer/ans9/ans.py
+index 25da6b7..a9e7395 100644
+--- a/bin/tests/system/xfer/ans9/ans.py
++++ b/bin/tests/system/xfer/ans9/ans.py
+@@ -13,6 +13,7 @@ information regarding copyright ownership.
+
+ from collections.abc import AsyncGenerator
+
++import dns.name
+ import dns.rcode
+ import dns.rdatatype
+ import dns.rrset
+@@ -33,7 +34,7 @@ class AXFRServer(DomainHandler):
+     version.
+     """
+
+-    domains = ["xfr-and-reconfig"]
++    domains = ["xfr-and-reconfig", "private-dns-overrun"]
+
+     def __init__(self) -> None:
+         super().__init__()
+@@ -97,6 +98,34 @@ class AXFRServer(DomainHandler):
+
+         yield DnsResponseSend(txt_message)
+
++        if qctx.qname == dns.name.from_text("private-dns-overrun"):
++            # A message where the malformed DNSKEY algorithm identifier
++            # finishes on a 00 byte in the next record. Assumes the
++            # next record starts with a compression pointer which is
++            # followed by the type which starts with 00.
++
++            # Generate malformed PRIVATE DNS DNSKEY
++            dnskey_message = qctx.prepare_new_response()
++            dnskey_rrset = dns.rrset.from_text(
++                qctx.qname,
++                300,
++                qctx.qclass,
++                dns.rdatatype.DNSKEY,
++                "\\# 12 00 00 00 fd 09 00 00 00 00 00 00 00",
++            )
++            dnskey_message.answer.append(dnskey_rrset)
++            # Generate well formed PRIVATE DNS DNSKEY
++            dnskey_rrset = dns.rrset.from_text(
++                qctx.qname,
++                300,
++                qctx.qclass,
++                dns.rdatatype.DNSKEY,
++                "\\# 12 00 00 00 fd 06 00 00 00 00 00 00 00",
++            )
++            dnskey_message.answer.append(dnskey_rrset)
++
++            yield DnsResponseSend(dnskey_message)
++
+         # Finish the AXFR transaction by sending the second SOA RRset.
+         yield DnsResponseSend(soa_message)
+
+diff --git a/bin/tests/system/xfer/ns6/named.conf.j2 b/bin/tests/system/xfer/ns6/named.conf.j2
+index 80f4281..c262f9d 100644
+--- a/bin/tests/system/xfer/ns6/named.conf.j2
++++ b/bin/tests/system/xfer/ns6/named.conf.j2
+@@ -118,3 +118,12 @@ zone "ixfr-race" {
+ 	primaries { 10.53.0.11; };
+ 	file "ixfr-race.bk";
+ };
++
++# GL#6004
++zone "private-dns-overrun" {
++	type secondary;
++	primaries { 10.53.0.9; };
++	file "private-dns-overrun.bk";
++	masterfile-format text; # force bug to be exercised
++	request-ixfr no; # ans9 supports only axfr
++};
+diff --git a/bin/tests/system/xfer/tests_xfer.py b/bin/tests/system/xfer/tests_xfer.py
+index b87a75f..1060a70 100644
+--- a/bin/tests/system/xfer/tests_xfer.py
++++ b/bin/tests/system/xfer/tests_xfer.py
+@@ -544,6 +544,16 @@ def test_reconfiguration_when_zone_transfer_is_in_the_middle_of_soa_query(ns6):
+         watcher_transfer_started.wait_for_line("Transfer started")
+
+
++def test_malformed_private_dns_identifier_overrun(ns6):
++    isctest.log.info(
++        "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected"
++    )
++    with ns6.watch_log_from_start(timeout=60) as watcher_transfer_completed:
++        watcher_transfer_completed.wait_for_line(
++            "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input"
++        )
++
++
+ # See #5767
+ def test_ixfr_race(ns6):
+     isctest.log.info(
+diff --git a/lib/dns/name.c b/lib/dns/name.c
+index aede7da..9436220 100644
+--- a/lib/dns/name.c
++++ b/lib/dns/name.c
+@@ -1492,7 +1492,7 @@ dns_name_fromwire(dns_name_t *const name, isc_buffer_t *const source,
+ 	 * The amount of the source we consumed is set once.
+ 	 */
+ 	const uint8_t *const source_buf = isc_buffer_base(source);
+-	const uint8_t *const source_max = isc_buffer_used(source);
++	const uint8_t *const source_max = isc_buffer_active(source);
+ 	const uint8_t *const start = isc_buffer_current(source);
+ 	const uint8_t *marker = start;
+ 	const uint8_t *cursor = start;
+diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
+index 42549ac..bd18777 100644
+--- a/lib/dns/rdata.c
++++ b/lib/dns/rdata.c
+@@ -591,7 +591,7 @@ check_private(isc_buffer_t *source, dns_secalg_t alg) {
+ 		dns_fixedname_t fixed;
+
+ 		RETERR(dns_name_fromwire(dns_fixedname_initname(&fixed), source,
+-					 DNS_DECOMPRESS_DEFAULT, NULL));
++					 DNS_DECOMPRESS_NEVER, NULL));
+ 	} else if (alg == DNS_KEYALG_PRIVATEOID) {
+ 		/*
+ 		 * Check that we can extract the OID from the start of the
+diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c
+index 6dd6e0c..61f3a41 100644
+--- a/tests/dns/rdata_test.c
++++ b/tests/dns/rdata_test.c
+@@ -2276,6 +2276,25 @@ ISC_RUN_TEST_IMPL(key) {
+
+ 	check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in,
+ 		    dns_rdatatype_key, sizeof(dns_rdata_key_t));
++
++	/*
++	 * A valid PRIVATEDNS record with an active region shorter than the
++	 * actual record length.  A bug in dns_name_fromwire meant that this
++	 * was previously accepted.
++	 */
++	unsigned char key[] = { 0x00, 0x00, 0x00, 253, 0x07, 'e', 'x',
++				'a',  'm',  'p',  'l', 'e',  0x00 };
++	unsigned char buf[sizeof(key)];
++	isc_buffer_t source, target;
++	isc_result_t result;
++
++	isc_buffer_init(&source, key, sizeof(key));
++	isc_buffer_add(&source, sizeof(key));
++	isc_buffer_setactive(&source, sizeof(key) - 1);
++	isc_buffer_init(&target, buf, sizeof(buf));
++	result = dns_rdata_fromwire(NULL, dns_rdataclass_in, dns_rdatatype_key,
++				    &source, DNS_DECOMPRESS_ALWAYS, &target);
++	assert_int_not_equal(result, ISC_R_SUCCESS);
+ }
+
+ /*

debian/patches/CVE-2026-11331.patch

@@ -0,0 +1,20 @@
+Description: CVE-2026-11331 - 安全修复
+Author: Mark Andrews <marka@isc.org>
+Origin: https://github.com/isc-projects/bind9/commit/b950da5f625488e2b84575f75052c5f366a4cb06
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-11331
+Last-Update: 2026-06-12
+---
+diff --git a/lib/ns/query.c b/lib/ns/query.c
+index bd763c6..08f0a1a 100644
+--- a/lib/ns/query.c
++++ b/lib/ns/query.c
+@@ -7544,7 +7544,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) {
+ 					      qctx->fname, NULL);
+ 		if (result == DNS_R_NAMETOOLONG) {
+ 			client->message->rcode = dns_rcode_yxdomain;
+-		} else if (result != ISC_R_SUCCESS) {
++		}
++		if (result != ISC_R_SUCCESS) {
+ 			return result;
+ 		}
+ 	} else {

debian/patches/CVE-2026-11605.patch

@@ -0,0 +1,21 @@
+Description: CVE-2026-11605 - 安全修复
+Author: Ondřej Surý <ondrej@sury.org>
+Origin: https://github.com/isc-projects/bind9/commit/c3388378a7699c956603bc405f73e38d2c344dc8
+Bug: https://nvd.nist.gov/vuln/detail/CVE-2026-11605
+Last-Update: 2026-06-07 10:19:44 +0200
+---
+diff --git a/lib/dns/validator.c b/lib/dns/validator.c
+index dc7b990..b8267b2 100644
+--- a/lib/dns/validator.c
++++ b/lib/dns/validator.c
+@@ -898,6 +898,10 @@ validator_callback_nsec(void *arg) {
+ 		switch (eresult) {
+ 		case ISC_R_CANCELED:
+ 		case ISC_R_SHUTTINGDOWN:
++		case ISC_R_QUOTA:
++			val->attributes |= subvalidator->attributes &
++					   (VALATTR_MAXVALIDATIONS |
++					    VALATTR_MAXVALIDATIONFAILS);
+ 			result = eresult;
+ 			break;
+ 		case DNS_R_BROKENCHAIN: