mbox series

[scarthgap,v2,0/3] perl: fix multiple CVEs

Message ID 20260721142336.21513-1-jaipaul.cheernam@est.tech
Headers show
Series perl: fix multiple CVEs | expand

Message

Jaipaul Cheernam July 21, 2026, 2:23 p.m. UTC 
Fix three security vulnerabilities in perl 5.38.4:

- CVE-2026-13221: regex trie overflow causing incorrect matches when
  alternation has more than 65535 fixed string branches (CVSS 9.1)
- CVE-2026-57432: integer overflow in pack/unpack leading to
  out-of-bounds heap read (CVSS 8.4)
- CVE-2025-40909: threads working directory race condition allowing
  file operations to target unintended paths

Changes since v1:
- Added CVE-2025-40909 fix with companion perlcross patch for
  d_fdopendir configuration detection

CVE-2025-40909 is fixed upstream in perl 5.42.0. CVE-2026-13221 and
CVE-2026-57432 are fixed upstream in perl 5.44.0.

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---

Changes in v2:
- Added companion perlcross patch (CVE-2025-40909-dep) to add
  d_fdopendir configuration detection required by the CVE fix

Jaipaul Cheernam (3):
  perl: fix CVE-2026-13221
  perl: fix CVE-2026-57432
  perl: fix CVE-2025-40909

 .../perl-cross/files/CVE-2025-40909-dep.patch |  25 ++
 .../perl-cross/perlcross_1.6.2.bb             |   1 +
 .../perl/files/CVE-2025-40909.patch           | 412 ++++++++++++++++++
 .../perl/files/CVE-2026-13221.patch           |  75 ++++
 .../perl/files/CVE-2026-57432-01.patch        |  52 +++
 .../perl/files/CVE-2026-57432-02.patch        |  34 ++
 meta/recipes-devtools/perl/perl_5.38.4.bb     |   4 +
 7 files changed, 603 insertions(+)
 create mode 100644 meta/recipes-devtools/perl-cross/files/CVE-2025-40909-dep.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2025-40909.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-13221.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-01.patch
 create mode 100644 meta/recipes-devtools/perl/files/CVE-2026-57432-02.patch