The ISC SPNEGO implementation is based on mod_auth_kerb code. When
CVE-2006-5989 was disclosed, the relevant fix was not applied to the
BIND 9 codebase, making the latter vulnerable to the aforementioned flaw
when "tkey-gssapi-keytab" or "tkey-gssapi-credential" is set in
named.conf.
The original description of CVE-2006-5989 was:
Off-by-one error in the der_get_oid function in mod_auth_kerb 5.0
allows remote attackers to cause a denial of service (crash) via a
crafted Kerberos message that triggers a heap-based buffer overflow
in the component array.
Later research revealed that this flaw also theoretically enables remote
code execution, though achieving the latter in real-world conditions is
currently deemed very difficult.
This vulnerability was responsibly reported as ZDI-CAN-12302 ("ISC BIND
TKEY Query Heap-based Buffer Overflow Remote Code Execution
Vulnerability") by Trend Micro Zero Day Initiative.
The --enable-option-checking=fatal option prevents ./configure from
proceeding when an unknown option is used in the ./configure step in CI.
This change will avoid adding unsupported ./configure options or options
with typo or typo in pairwise testing "# [pairwise: ...]" marker.
(cherry picked from commit 4295c82e45)
The --enable-pthread-rwlock and --enable-mutex-atomics switches for
./configure are not available in BIND 9.11. Do not attempt using them
in GitLab CI.
As we generate manual pages from DocBook sources, we don't have absolute
control on manual page output and therefore 'mandoc -Tlint' may always
report warnings we can't eliminate. In light of this linting level was
set for mandoc to '-Werror' to ignore warnings and style issues, only
errors are reported.
(cherry picked from commit 22fdcb30db)
-fsanitize=thread hijacks dlopen() and dlclose(), therefore dlopen()
won't request -ldl to be used for linking during Autoconf test. Check
for dlsym() presence will fail and dlzexternal and dyndb system tests
won't run.
Retrieved from 2dd54fa62f.
Some merge requests (e.g. those created for release branches) include
merge commits. Prevent Danger from warning about excessive subject line
length for merge commits. (While the proper way to detect a merge
commit would be to check the 'parents' attribute of a commit object,
Danger Python does not seem to populate that attribute, so a simple
string search is performed on the commit subject instead.)
(cherry picked from commit bc42690c99)
The Danger GitLab CI job currently flags excessively long lines in
commit log messages. Exclude lines containing references (i.e. starting
with "[1]", "[2]", etc.) from this check. This allows e.g. long URLs to
be included in commit log messages without triggering Danger warnings.
(cherry picked from commit 09964e8085)
The Danger GitLab CI job currently generates a separate error message
about fixup commits being present in a merge request for every such
commit found. Prevent that by making it only log that error message
once per run.
(cherry picked from commit 801d13f62f)
Make the Danger GitLab CI job fail when the subject line for any commit
belonging to a merge request contains a trailing dot.
(cherry picked from commit 953c810f41)
Make the Danger GitLab CI job fail when a merge request adds a new
./configure switch without also adding a "# [pairwise: ...]" marker that
the relevant GitLab CI job uses for preparing the pairwise testing
model. This helps to ensure that any newly added ./configure switches
are tested by the pairwise testing GitLab CI job.
(cherry picked from commit ff58ec8cef)
Make Danger suggest adding a release note to a merge request if the
latter is marked with the "Customer" label but not with the "Release
Notes" label.
(cherry picked from commit d81ad454cc)
Make the Danger GitLab CI job fail when a merge request targeting a
branch different than "main" adds any [placeholder] entries to the
CHANGES file. Prevent Danger from flagging missing GitLab identifiers
for [placeholder] CHANGES entries.
(cherry picked from commit 2f77c7680a)
Make Danger ensure that if a merge request fixes a security issue then
that merge request includes a CHANGES entry and a release note, both of
which contain a CVE identifier.
(cherry picked from commit 97364f5518)
Ondřej SurýandMichał Kępień
Petr Špaček
Michal Nowak
Mark AndrewsandMichal Nowak
Tinderbox UserandMichał Kępień