cvs-1.11-2.src.rpm does not build because the cvs-1.11-security.patch fails to apply. I'm using rpm-3.0.5-9.6x and patch-2.5-10. The problem is that the cvs-1.11-security.patch is has DOS line-end terminators. Converting to UNIX line-ends does the trick.
This will be fixed in cvs-1.11-3. Updating to patch 2.5.4 should also work around this. Thanks!