folkslinux
/
CBL-Mariner
mirror of https://github.com/microsoft/CBL-Mariner.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bind: fix CVE-2020-8625 (#675) 

Co-authored-by: Nicolas Guibourge <nicolasg@microsoft.com>
This commit is contained in:
nicolas guibourge 2021-03-01 10:12:19 -08:00 committed by GitHub
parent 6eee32f12a
commit 44f672d00b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
SPECS/bind/CVE-2020-8625.patch Normal file
View File

@ -0,0 +1,12 @@
diff -urN bind-9.16.3-original/lib/dns/spnego.c bind-9.16.3/lib/dns/spnego.c
--- bind-9.16.3-original/lib/dns/spnego.c 2021-03-01 08:56:47.639826977 -0800
+++ bind-9.16.3/lib/dns/spnego.c 2021-03-01 08:58:57.223786168 -0800
@@ -842,7 +842,7 @@
return (ASN1_OVERRUN);
}
- data->components = malloc(len * sizeof(*data->components));
+ data->components = malloc((len + 1) * sizeof(*data->components));
if (data->components == NULL) {
return (ENOMEM);
}

5
SPECS/bind/bind.spec
View File

@ -1,7 +1,7 @@
Summary: Domain Name System software
Name: bind
Version: 9.16.3
Release: 2%{?dist}
Release: 3%{?dist}
License: ISC
URL: https://www.isc.org/downloads/bind/
Source0: https://ftp.isc.org/isc/bind9/%{version}/%{name}-%{version}.tar.xz
@ -15,6 +15,7 @@ Patch5: CVE-2020-8622.patch
# CVE-2020-8623 only impacts package built with "--enable-native-pkcs11"
Patch6: CVE-2020-8623.nopatch
Patch7: CVE-2020-8624.patch
Patch8: CVE-2020-8625.patch
Group: Development/Tools
Vendor: Microsoft Corporation
Distribution: Mariner
@ -93,6 +94,8 @@ fi
%{_prefix}/lib/tmpfiles.d/named.conf
%changelog
* Mon Mar 01 2021 Nicolas Guibourge <nicolasg@microsoft.com> - 9.16.3-3
- Fixes CVE-2020-8625
* Fri Sep 11 2020 Ruying Chen <v-ruyche@microsoft.com> - 9.16.3-2
- Fixes CVE-2020-8618, CVE-2020-8619, CVE-2020-8620,
- CVE-2020-8621, CVE-2020-8622, CVE-2020-8623, CVE-2020-8624