Debian Patches

Status for designate/1:22.0.0-2

Patch Description Author Forwarded Bugs Origin Last update
Require_TSIG_keys_for_zones_in_non-default_pools.patch Require TSIG keys for zones in non-default pools Add validation during zone creation and pool moves to ensure that
non-default pools have TSIG keys configured. Without TSIG, MDNS
defaults to searching only in the default pool, causing zones in
other pools to fail with 'ZoneNotFound' errors during AXFR,
leaving them stuck in ERROR status.
.
This provides fail-fast behavior with a clear error message,
rather than allowing zones to silently fail during synchronization.
.
Note: this does not change existing API behavior for the user as
the zone would get into ERROR eventually without a TSIG key.
.
Documentation has been added to explain the TSIG requirement for
multi-pool deployments.

===================================================================		 Omer <oschwart@redhat.com> yes debian upstream upstream, https://review.opendev.org/c/openstack/designate/+/998006 2026-08-06
install-missing-files.patch Install missing files Thomas Goirand <zigo@debian.org> not-needed 2016-03-25
removed-httpdomain-sphinx-ext.patch Removed httpdomain sphinx ext
===================================================================		 Thomas Goirand <zigo@debian.org> no 2021-03-26
add-new-floatingip-handler.patch Add new floating IP handler for sink
===================================================================		 Axel Jacquet <axel.jacquet@infomaniak.com> no 2023-03-08
fix-regex-to-create-floating-ptr.patch Fix regex to create floating PTR. Axel Jacquet <axel.jacquet@infomaniak.com> no 2024-06-27
Fix_mDNS_record_query_pool_scoping_for_split-horizon_DNS.patch Fix mDNS record query pool scoping for split-horizon DNS _handle_record_query did not use TSIG-based pool scoping when looking
up recordsets. When the same zone name exists in multiple pools (e.g.
split-horizon with BIND views), find_recordset found multiple SOA
records and returned REFUSED.
.
Use _zone_criterion_from_request to resolve the zone by pool first,
then look up the recordset within that zone. Falls back to the
recordset-first path for subdomain queries.

diff --git a/designate/mdns/handler.py b/designate/mdns/handler.py
index 85ab764..f14e8e4 100644		 Omer <oschwart@redhat.com> yes debian upstream https://review.opendev.org/c/openstack/designate/+/998005 2026-08-06
CVE-2026-71193_CVE-2026-71194_Fix_cross-tenant_cross-pool_zone_ownership_bypass.patch Fix cross-tenant/cross-pool zone ownership bypass Zone ownership checks (duplicate-name, subzone, superzone) and mDNS
record/NOTIFY lookups only ever considered the zone's own pool, so a
tenant could bypass all three ownership protections against another
tenant's zone by scheduling to a different pool, and could trigger an
ambiguous-lookup DoS in mDNS via a colliding zone name in another pool.
.
Add _check_zone_ownership_conflicts(), called from create_zone() before
pool scheduling, which searches for exact-name/subzone/superzone
conflicts across all pools and rejects them only when the conflicting
zone belongs to a different tenant. Same-tenant use of an identical or
overlapping name across pools (split-horizon, pool migrations) is
preserved unchanged.
.
Fix the two unscoped mDNS lookups this bypass made exploitable:
_handle_record_query() now walks from the query name up through its
ancestors, scoping each candidate by the TSIG-derived (or default)
pool_id, with no remaining unscoped fallback. _handle_notify() now
fetches every zone matching the name and disambiguates using the trust
check it already performs - whether the sending IP is a configured
master for that zone - since NOTIFY has no TSIG relationship to scope
by.

===================================================================		 Omer <oschwart@redhat.com> yes debian upstream pre-OSSA mailing list 2026-08-06

All known versions for source package 'designate'

Links