Debian Patches
Status for designate/1:15.0.2-0+deb11u1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| CVE-2026-71193_CVE-2026-71194_Fix_cross-tenant_cross-pool_zone_ownership_bypass.patch | Fix cross-tenant/cross-pool zone ownership bypass Zone ownership checks (duplicate-name, subzone, superzone) and mDNS record/NOTIFY lookups only ever considered the zone's own pool, so a tenant could bypass all three ownership protections against another tenant's zone by scheduling to a different pool, and could trigger an ambiguous-lookup DoS in mDNS via a colliding zone name in another pool. . Add _check_zone_ownership_conflicts(), called from create_zone() before pool scheduling, which searches for exact-name/subzone/superzone conflicts across all pools and rejects them only when the conflicting zone belongs to a different tenant. Same-tenant use of an identical or overlapping name across pools (split-horizon, pool migrations) is preserved unchanged. . Fix the two unscoped mDNS lookups this bypass made exploitable: _handle_record_query() now walks from the query name up through its ancestors, scoping each candidate by the TSIG-derived (or default) pool_id, with no remaining unscoped fallback. _handle_notify() now fetches every zone matching the name and disambiguates using the trust check it already performs - whether the sending IP is a configured master for that zone - since NOTIFY has no TSIG relationship to scope by. =================================================================== |
Omer <oschwart@redhat.com> | yes | debian upstream | upstream, pre-OSSA mailing list | 2026-08-06 |
| install-missing-files.patch | Install missing files | Thomas Goirand <zigo@debian.org> | not-needed | 2016-03-25 | ||
| removed-httpdomain-sphinx-ext.patch | Removed httpdomain sphinx ext | Thomas Goirand <zigo@debian.org> | no | 2021-03-26 | ||
| Fix-mdns-test_handler-setup.patch | Fix mdns test_handler setup If the unit tests were run isolated from the larger test suite, the mdns test_handler unit tests would fail with "AssertionError: 'TRANSPORT' must not be None" because the messaging and RPC fixtures were not setup for the test suite. This patch adds the required test fixtures to the mdns test_handler setUp(). |
Michael Johnson <johnsomor@gmail.com> | no | 2022-09-20 | ||
| do-not-use-docutils-set_class.patch | Do not use docutils's set_class() This deprecated, and make the build fails. | Thomas Goirand <zigo@debian.org> | no | 2023-01-24 | ||
| add-new-floatingip-handler.patch | Add new floating IP handler for sink =================================================================== |
Axel Jacquet <axel.jacquet@infomaniak.com> | no | 2023-03-08 | ||
| Require_TSIG_keys_for_zones_in_non-default_pools.patch | Require TSIG keys for zones in non-default pools Add validation during zone creation and pool moves to ensure that non-default pools have TSIG keys configured. Without TSIG, MDNS defaults to searching only in the default pool, causing zones in other pools to fail with 'ZoneNotFound' errors during AXFR, leaving them stuck in ERROR status. . This provides fail-fast behavior with a clear error message, rather than allowing zones to silently fail during synchronization. . Note: this does not change existing API behavior for the user as the zone would get into ERROR eventually without a TSIG key. . Documentation has been added to explain the TSIG requirement for multi-pool deployments. =================================================================== |
Omer <oschwart@redhat.com> | no | debian upstream | 2026-08-11 | |
| Fix_mDNS_record_query_pool_scoping_for_split-horizon_DNS.patch | Fix mDNS record query pool scoping for split-horizon DNS _handle_record_query did not use TSIG-based pool scoping when looking up recordsets. When the same zone name exists in multiple pools (e.g. split-horizon with BIND views), find_recordset found multiple SOA records and returned REFUSED. . Use _zone_criterion_from_request to resolve the zone by pool first, then look up the recordset within that zone. Falls back to the recordset-first path for subdomain queries. =================================================================== |
Omer <oschwart@redhat.com> | yes | debian upstream | upstream, https://review.opendev.org/c/openstack/designate/+/998029 | 2028-08-06 |
All known versions for source package 'designate'
- 1:22.0.0-2 (sid, forky)
- 1:20.0.0-2+deb13u1 (trixie-security)
- 1:20.0.0-2 (trixie)
- 1:15.0.2-0+deb11u1 (bookworm-security)
- 1:15.0.0-4 (bookworm)