From 122de2529968533462d36324eb16080a5337b795 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Apr 29 2021 13:02:59 +0000
Subject: import bind-9.11.4-26.P2.el7_9.5


---

diff --git a/SOURCES/bind-9.11-CVE-2021-25215.patch b/SOURCES/bind-9.11-CVE-2021-25215.patch
new file mode 100644
index 0000000..4f62a10
--- /dev/null
+++ b/SOURCES/bind-9.11-CVE-2021-25215.patch
@@ -0,0 +1,40 @@
+From 6fc38d1c75ce5a6172267e6ca162c4fdc09657ad Mon Sep 17 00:00:00 2001
+From: Petr Mensik <pemensik@redhat.com>
+Date: Tue, 27 Apr 2021 10:56:12 +0200
+Subject: [PATCH 2/2] CVE-2021-25215
+
+5616.	[security]	named crashed when a DNAME record placed in the ANSWER
+			section during DNAME chasing turned out to be the final
+			answer to a client query. (CVE-2021-25215) [GL #2540]
+---
+ bin/named/query.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/bin/named/query.c b/bin/named/query.c
+index a95f5ad..11a888e 100644
+--- a/bin/named/query.c
++++ b/bin/named/query.c
+@@ -9301,10 +9301,17 @@ query_find(ns_client_t *client, dns_fetchevent_t *event, dns_rdatatype_t qtype)
+ 		if (noqname != NULL)
+ 			query_addnoqnameproof(client, noqname);
+ 		/*
+-		 * We shouldn't ever fail to add 'rdataset'
+-		 * because it's already in the answer.
++		 * 'rdataset' will only be non-NULL here if the ANSWER section
++		 * of the message to be sent to the client already contains an
++		 * RRset with the same owner name and the same type as
++		 * 'rdataset'.  This should never happen, with one exception:
++		 * when chasing DNAME records, one of the DNAME records placed
++		 * in the ANSWER section may turn out to be the final answer to
++		 * the client's query, but we have no way of knowing that until
++		 * now.  In such a case, 'rdataset' will be freed later, so we
++		 * do not need to free it here.
+ 		 */
+-		INSIST(rdataset == NULL);
++		INSIST(rdataset == NULL || qtype == dns_rdatatype_dname);
+ 	}
+ 
+  addauth:
+-- 
+2.26.3
+
diff --git a/SPECS/bind.spec b/SPECS/bind.spec
index 602b5bd..e2c34f2 100644
--- a/SPECS/bind.spec
+++ b/SPECS/bind.spec
@@ -64,7 +64,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.4
-Release:  26%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.4
+Release:  26%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}.5
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -178,6 +178,7 @@ Patch191: bind-9.11-CVE-2020-8624.patch
 Patch192: bind98-rh1769876.patch
 Patch193: bind-9.11-rh1889902.patch
 Patch194: bind-9.11-CVE-2020-8625.patch
+Patch195: bind-9.11-CVE-2021-25215.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -549,6 +550,7 @@ are used for building ISC DHCP.
 %patch192 -p1 -b .rh1769876
 %patch193 -p1 -b .rh1889902
 %patch194 -p1 -b .CVE-2020-8625
+%patch195 -p1 -b .CVE-2021-25215
 
 # Override upstream builtin keys
 cp -fp %{SOURCE29} bind.keys
@@ -1530,6 +1532,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Tue Apr 27 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.5
+- Possible assertion failure on DNAME processing (CVE-2021-25215)
+
 * Mon Feb 15 2021 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-26.P2.4
 - Fix off-by-one bug in ISC SPNEGO implementation (CVE-2020-8625)