From 1c4d899d2d87625b6434d379e518b832882c6295 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 11 Sep 2026 11:09:09 +1200 Subject: [PATCH] unbound: patch CVE-2026-42960 Details: https://nvd.nist.gov/vuln/detail/cve-2026-42960 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-42960.patch | 38 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-42960.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-42960.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-42960.patch new file mode 100644 index 0000000000..13f99d4803 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-42960.patch @@ -0,0 +1,38 @@ +From 7bd2ccb4a490b95ee9e8297ebbcb8fec91d11859 Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 20 May 2026 10:20:45 +0200 +Subject: [PATCH] - Fix CVE-2026-42960, Possible cache poisoning attack while + following delegation. Thanks to TaoFei Guo from Peking University, Yang Luo + and JianJun Chen, Tsinghua University, for the report. + +(cherry picked from commit 8ae4b4545dccaaabd30b597b0dcb0d9640c8cc39) + +CVE: CVE-2026-42960 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8ae4b4545dccaaabd30b597b0dcb0d9640c8cc39] + +Dropped changes to the Changelog file. + +Signed-off-by: Ankur Tyagi +--- + iterator/iter_scrub.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/iterator/iter_scrub.c b/iterator/iter_scrub.c +index 8507a3fb6..852705db3 100644 +--- a/iterator/iter_scrub.c ++++ b/iterator/iter_scrub.c +@@ -725,7 +725,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, + rrset->rrset_all_next = NULL; + return 1; + } +- mark_additional_rrset(pkt, msg, rrset); ++ /* Only mark glue as allowed for type NS in the authority ++ * section. Other RR types do not get glue for them, it ++ * is allowed from the answer section, but not authority ++ * so that a message can not have address records cached ++ * as a side effect to the query. */ ++ if(rrset->type==LDNS_RR_TYPE_NS) ++ mark_additional_rrset(pkt, msg, rrset); + prev = rrset; + rrset = rrset->rrset_all_next; + } diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index 7ed5769c69..a6f9b14cab 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -20,6 +20,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-41292.patch \ file://CVE-2026-42534.patch \ file://CVE-2026-42923.patch \ + file://CVE-2026-42960.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"