From 1cede7d75e0be4c9b65c9fc5c7c3fc04e96ccbf8 Mon Sep 17 00:00:00 2001 From: Ankur Tyagi Date: Fri, 11 Sep 2026 11:09:24 +1200 Subject: [PATCH] unbound: patch CVE-2026-54478 Details: https://nvd.nist.gov/vuln/detail/cve-2026-54478 Signed-off-by: Ankur Tyagi Signed-off-by: Anuj Mittal --- .../unbound/unbound/CVE-2026-54478.patch | 38 +++++++++++++++++++ .../recipes-support/unbound/unbound_1.24.2.bb | 1 + 2 files changed, 39 insertions(+) create mode 100644 meta-networking/recipes-support/unbound/unbound/CVE-2026-54478.patch diff --git a/meta-networking/recipes-support/unbound/unbound/CVE-2026-54478.patch b/meta-networking/recipes-support/unbound/unbound/CVE-2026-54478.patch new file mode 100644 index 0000000000..3580815477 --- /dev/null +++ b/meta-networking/recipes-support/unbound/unbound/CVE-2026-54478.patch @@ -0,0 +1,38 @@ +From 44af1c8b392afb7d14ae0814fb9c6c037a5bf18a Mon Sep 17 00:00:00 2001 +From: "W.C.A. Wijngaards" +Date: Wed, 22 Jul 2026 10:16:42 +0200 +Subject: [PATCH] - Fix CVE-2026-54478, DNS Cookie bypass when combined with + proxy-protocol use. Thanks to Qifan Zhang, Palo Alto Networks, for the + report. + +(cherry picked from commit 8a15ffee620bce05fbfd2c69b0d4c31c10a02431) + +CVE: CVE-2026-54478 +Upstream-Status: Backport [https://github.com/NLnetLabs/unbound/commit/8a15ffee620bce05fbfd2c69b0d4c31c10a02431] + +Signed-off-by: Ankur Tyagi +--- + util/data/msgparse.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/util/data/msgparse.c b/util/data/msgparse.c +index 169709b7e..3dc2e1264 100644 +--- a/util/data/msgparse.c ++++ b/util/data/msgparse.c +@@ -1068,13 +1068,13 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, + * purposes. It will be overwritten if (re)creation + * is needed. + */ +- if(repinfo->remote_addr.ss_family == AF_INET) { ++ if(repinfo->client_addr.ss_family == AF_INET) { + memcpy(server_cookie + 16, +- &((struct sockaddr_in*)&repinfo->remote_addr)->sin_addr, 4); ++ &((struct sockaddr_in*)&repinfo->client_addr)->sin_addr, 4); + } else { + cookie_is_v4 = 0; + memcpy(server_cookie + 16, +- &((struct sockaddr_in6*)&repinfo->remote_addr)->sin6_addr, 16); ++ &((struct sockaddr_in6*)&repinfo->client_addr)->sin6_addr, 16); + } + + if(cfg->cookie_secret_file && diff --git a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb index a03dcf4193..1e3bd6f5c6 100644 --- a/meta-networking/recipes-support/unbound/unbound_1.24.2.bb +++ b/meta-networking/recipes-support/unbound/unbound_1.24.2.bb @@ -35,6 +35,7 @@ SRC_URI = "git://github.com/NLnetLabs/unbound.git;protocol=https;branch=master;t file://CVE-2026-50251.patch \ file://CVE-2026-50252.patch \ file://CVE-2026-52863.patch \ + file://CVE-2026-54478.patch \ " SRCREV = "f6269baa605d31859f28770e01a24e3677e5f82c"