Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package pdns-recursor for openSUSE:Factory checked in at 2026-11-11 21:18:41 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/pdns-recursor (Old) and /work/SRC/openSUSE:Factory/.pdns-recursor.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "pdns-recursor" Wed Nov 11 21:18:41 2026 rev:73 rq:1396928 version:5.4.8 Changes: -------- --- /work/SRC/openSUSE:Factory/pdns-recursor/pdns-recursor.changes 2025-11-20 14:52:17.579222749 +0100 +++ /work/SRC/openSUSE:Factory/.pdns-recursor.new.3759290/pdns-recursor.changes 2026-11-11 21:18:53.821936634 +0100 @@ -1,0 +2,70 @@ +Fri Oct 23 08:30:00 UTC 2026 - Fridrich Strba <[email protected]> + +- Update to 5.4.8 + * Security fixes: + + PowerDNS Advisory 2025-06: + CVE-2025-59023, bsc#1252650 + CVE-2025-59024, bsc#1252651 + + PowerDNS Advisory 2025-07: + CVE-2025-59029, bsc#1254881 + + PowerDNS Advisory 2025-08: + CVE-2025-59030, bsc#1254877 + + PowerDNS Advisory 2026-01: + CVE-2026-0398, bsc#1257957 + CVE-2026-24027, bsc#1257956 + + PowerDNS Advisory 2026-03: + CVE-2026-33256, bsc#1262557 + CVE-2026-33257, bsc#1262536 + CVE-2026-33258, bsc#1262558 + CVE-2026-33259, bsc#1262559 + CVE-2026-33260, bsc#1262537 + CVE-2026-33261, bsc#1262560 + CVE-2026-33262, bsc#1262561 + CVE-2026-33600, bsc#1262563 + CVE-2026-33601, bsc#1262562 + + PowerDNS Advisory 2026-08: + CVE-2026-33612, bsc#1269208 + CVE-2026-40012, bsc#1269212 + CVE-2026-42005, bsc#1269201 + CVE-2026-42387, bsc#1269213 + CVE-2026-42388, bsc#1269214 + CVE-2026-42389, bsc#1269215 + CVE-2026-42390, bsc#1269216 + CVE-2026-52690, bsc#1269211 + + PowerDNS Advisory 2026-10: + CVE-2026-52686, bsc#1272395 + CVE-2026-52688, bsc#1272396 + + PowerDNS Advisory 2026-11: + CVE-2026-52682 + + PowerDNS Advisory 2026-12: + CVE-2026-73205, bsc#1286603 + CVE-2026-73206, bsc#1286604 + CVE-2026-85555, bsc#1286605 + CVE-2026-85556, bsc#1286606 + CVE-2026-85557, bsc#1286607 + CVE-2026-85558, bsc#1286608 + CVE-2026-85559, bsc#1286609 + * Full changelogs: + https://doc.powerdns.com/recursor/changelog/5.3.html + https://doc.powerdns.com/recursor/changelog/5.4.html +- Upstream tarball is now xz compressed +- Rust code moved from settings/rust to rec-rust-lib/rust; the + settings code generator now runs from make, and + effective_tld_names.dat is no longer shipped +- Regenerate vendor.tar.zst; adapt _service to current + obs-service-cargo (src is the tarball, custom-root) +- Added patch: + * CVE-2026-52684.patch (bsc#1272421) + + backport of upstream PR#17748: do not refresh NS records in + refresh-almost-expired; not in 5.4.8 +- Modified patch: + * cargo_build_fix.patch + + rediff for the rec-rust-lib/rust location + + build cargo C/C++ glue with -fno-lto: rustc cannot index + slim LTO objects in librecrust.a, cxxbridge symbols end up + undefined at link time +- Removed patch: + * boost-m4-39.patch + + integrated upstream + +------------------------------------------------------------------- Old: ---- boost-m4-39.patch pdns-recursor-5.2.5.tar.bz2 pdns-recursor-5.2.5.tar.bz2.sig New: ---- CVE-2026-52684.patch pdns-recursor-5.4.8.tar.xz pdns-recursor-5.4.8.tar.xz.sig ----------(Old B)---------- Old:- Removed patch: * boost-m4-39.patch + integrated upstream ----------(Old E)---------- ----------(New B)---------- New:- Added patch: * CVE-2026-52684.patch (bsc#1272421) + backport of upstream PR#17748: do not refresh NS records in ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ pdns-recursor.spec ++++++ --- /var/tmp/diff_new_pack.BIzE1L/_old 2026-11-11 21:18:56.311041032 +0100 +++ /var/tmp/diff_new_pack.BIzE1L/_new 2026-11-11 21:18:56.313041116 +0100 @@ -36,7 +36,7 @@ %endif Name: pdns-recursor -Version: 5.2.5 +Version: 5.4.8 Release: 0 BuildRequires: autoconf BuildRequires: automake @@ -94,8 +94,8 @@ # URL: https://www.powerdns.com/ -Source: https://downloads.powerdns.com/releases/%{name}-%{version}.tar.bz2 -Source10: https://downloads.powerdns.com/releases/%{name}-%{version}.tar.bz2.sig +Source: https://downloads.powerdns.com/releases/%{name}-%{version}.tar.xz +Source10: https://downloads.powerdns.com/releases/%{name}-%{version}.tar.xz.sig # on https://docs.powerdns.com/recursor/security.html but 404 right now, emailed them Source11: %{name}.keyring Source1: pdns-recursor.init @@ -105,8 +105,8 @@ Source99: series Patch1: boost_context.patch Patch2: cargo_build_fix.patch -# PATCH-FIX-OPENSUSE - use version 58 of boost.m4 -Patch3: boost-m4-39.patch +# PATCH-FIX-UPSTREAM bsc#1272421 CVE-2026-52684 https://github.com/PowerDNS/pdns/pull/17748 +Patch3: CVE-2026-52684.patch # Summary: Modern, advanced and high performance recursing/non authoritative nameserver License: GPL-2.0-or-later @@ -122,15 +122,11 @@ http://www.powerdns.com %prep -%autosetup -p1 -pushd settings/rust -tar --zstd -xf %{SOURCE3} -popd +%autosetup -p1 -a3 %build export CXX=g++%{?compiler_ver} autoreconf -fi -ln effective_tld_names.dat effective_tld_list.dat %configure \ --enable-reproducible \ --disable-silent-rules \ @@ -143,7 +139,6 @@ --with-socketdir=%{_rundir} \ --with-service-user=pdns \ --with-service-group=pdns -cd settings; /usr/bin/python3 generate.py make %{?_smp_mflags} %install ++++++ CVE-2026-52684.patch ++++++ >From 63f480d2072d85ff5cd6eeb324bd52bf5debd4f7 Mon Sep 17 00:00:00 2001 From: Otto Moerbeek <[email protected]> Date: Mon, 20 Jul 2026 13:27:22 +0200 Subject: [PATCH] rec: do not attempt to refresh NS records in refresh-almost-expired. If the auth responds *very* slowly and the records expire in between, the capping of TTLs is not enforced for lack of data. This does not happen on regular resolve as then then the child records are used immediately if not expired and thus valid, or the records *are* expired, and in that case not used. So this case can only happen if almost expired records are used to refresh the authoritative NS records. Signed-off-by: Otto Moerbeek <[email protected]> --- --- a/recpacketcache.cc +++ b/recpacketcache.cc @@ -129,7 +129,9 @@ *age = static_cast<uint32_t>(now - iter->d_creation); // we know ttl is > 0 auto ttl = static_cast<uint32_t>(iter->d_ttd - now); - if (s_refresh_ttlperc > 0 && !iter->d_submitted && taskQTypeIsSupported(qtype)) { + // Be wary of refreshing NS records, it could lead to ghosts if the record cache entry expires between + // sending out the request and the reply coming back in, as then the TTL capping does not work. + if (s_refresh_ttlperc > 0 && !iter->d_submitted && taskQTypeIsSupported(qtype) && qtype != QType::NS) { const dnsheader_aligned header(iter->d_packet.data()); const auto* headerPtr = header.get(); if (headerPtr->rcode == RCode::NoError) { --- a/recursor_cache.cc +++ b/recursor_cache.cc @@ -425,7 +425,10 @@ if (refresh) { return -1; } - if (!entry->d_submitted) { + // We do not want to refresh auth NS entries, as it could lead to ghost domains if an entry + // expires between submit and response coming in, as the TTL capping then does not work for + // lack of current TTL info. + if (!entry->d_submitted && (qtype != QType::NS || !entry->d_auth)) { pushRefreshTask(qname, qtype, entry->d_ttd, entry->d_netmask); entry->d_submitted = true; } ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.BIzE1L/_old 2026-11-11 21:18:56.374043675 +0100 +++ /var/tmp/diff_new_pack.BIzE1L/_new 2026-11-11 21:18:56.378043842 +0100 @@ -1,6 +1,6 @@ -mtime: 1762015431 -commit: 4f5d73a7dc7a369798142ed5160a78e0c3c6958fd6c0e7dc55c72b1bb2dcda30 -url: https://src.opensuse.org/dns/pdns-recursor.git -revision: 4f5d73a7dc7a369798142ed5160a78e0c3c6958fd6c0e7dc55c72b1bb2dcda30 +mtime: 1792747325 +commit: 80d6bf27028c98ab11c50df58cec66a5ae81eef65ce08c19fb8f8f130dcbe9ec +url: https://src.opensuse.org/dns/pdns-recursor +revision: 80d6bf27028c98ab11c50df58cec66a5ae81eef65ce08c19fb8f8f130dcbe9ec projectscmsync: https://src.opensuse.org/dns/_ObsPrj.git ++++++ _service ++++++ --- /var/tmp/diff_new_pack.BIzE1L/_old 2026-11-11 21:18:56.404044933 +0100 +++ /var/tmp/diff_new_pack.BIzE1L/_new 2026-11-11 21:18:56.408045101 +0100 @@ -1,6 +1,7 @@ <services> <service name="cargo_vendor" mode="manual"> - <param name="src">pdns-recursor-5.2.5/settings/rust/</param> + <param name="src">pdns-recursor-5.4.8.tar.xz</param> + <param name="custom-root">rec-rust-lib/rust</param> <param name="compression">zst</param> <param name="update">true</param> </service> @@ -8,4 +9,3 @@ </service> </services> - ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-10-23 11:22:05.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ cargo_build_fix.patch ++++++ --- /var/tmp/diff_new_pack.BIzE1L/_old 2026-11-11 21:18:56.562051560 +0100 +++ /var/tmp/diff_new_pack.BIzE1L/_new 2026-11-11 21:18:56.566051728 +0100 @@ -1,14 +1,12 @@ -Index: pdns-recursor-5.1.1/settings/rust/Makefile.am -=================================================================== ---- pdns-recursor-5.1.1.orig/settings/rust/Makefile.am -+++ pdns-recursor-5.1.1/settings/rust/Makefile.am -@@ -11,7 +11,7 @@ EXTRA_DIST = \ - - # should actually end up in a target specific dir... - libsettings.a lib.rs.h: src/bridge.rs src/lib.rs src/helpers.rs Cargo.toml Cargo.lock build.rs +--- a/rec-rust-lib/rust/Makefile.am 2026-10-23 10:44:32.292732035 +0200 ++++ b/rec-rust-lib/rust/Makefile.am 2026-10-23 11:07:02.708305916 +0200 +@@ -21,7 +21,7 @@ + src/lib.rs \ + src/misc.rs \ + src/web.rs - SYSCONFDIR=$(sysconfdir) NODCACHEDIRNOD=$(localstatedir)/nod NODCACHEDIRUDR=$(localstatedir)/udr $(CARGO) build --release $(RUST_TARGET) --target-dir=$(builddir)/target --manifest-path ${srcdir}/Cargo.toml -+ unset LIBSSH2_SYS_USE_PKG_CONFIG && CARGO_FEATURE_VENDORED=1 RUSTFLAGS=" -Clink-arg=-Wl,-z,relro,-z,now -C debuginfo=2 -C incremental=false" SYSCONFDIR=$(sysconfdir) NODCACHEDIRNOD=$(localstatedir)/nod NODCACHEDIRUDR=$(localstatedir)/udr $(CARGO) build --release --offline $(RUST_TARGET) --target-dir=$(builddir)/target --manifest-path ${srcdir}/Cargo.toml - cp target/$(RUSTC_TARGET_ARCH)/release/libsettings.a libsettings.a - cp target/$(RUSTC_TARGET_ARCH)/cxxbridge/settings/src/lib.rs.h lib.rs.h - cp target/$(RUSTC_TARGET_ARCH)/cxxbridge/rust/cxx.h cxx.h ++ unset LIBSSH2_SYS_USE_PKG_CONFIG && CARGO_FEATURE_VENDORED=1 CFLAGS="$(CFLAGS) -fno-lto" CXXFLAGS="$(CXXFLAGS) -fno-lto" RUSTFLAGS=" -Clink-arg=-Wl,-z,relro,-z,now -C debuginfo=2 -C incremental=false" SYSCONFDIR=$(sysconfdir) NODCACHEDIRNOD=$(localstatedir)/nod NODCACHEDIRUDR=$(localstatedir)/udr $(CARGO) build --release --offline $(RUST_TARGET) --target-dir=$(builddir)/target --manifest-path ${srcdir}/Cargo.toml + cp -pv target/$(RUSTC_TARGET_ARCH)/release/librecrust.a librecrust.a + cp -pv target/$(RUSTC_TARGET_ARCH)/cxxbridge/recrust/src/lib.rs.h lib.rs.h + cp -pv target/$(RUSTC_TARGET_ARCH)/cxxbridge/recrust/src/web.rs.h web.rs.h ++++++ series ++++++ --- /var/tmp/diff_new_pack.BIzE1L/_old 2026-11-11 21:18:56.638054748 +0100 +++ /var/tmp/diff_new_pack.BIzE1L/_new 2026-11-11 21:18:56.642054916 +0100 @@ -1,3 +1,4 @@ boost_context.patch cargo_build_fix.patch +CVE-2026-52684.patch ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/pdns-recursor/vendor.tar.zst /work/SRC/openSUSE:Factory/.pdns-recursor.new.3759290/vendor.tar.zst differ: char 7, line 1
