diff mbox series

[meta-oe,wrynose,3/5] libdbi-perl: Fix CVE-2026-14380

Message ID 20260729091840.84531-3-hthakar@cisco.com
State New
Headers show
Series [meta-oe,wrynose,1/5] libdbi-perl: Fix CVE-2026-9698 | expand

Commit Message

Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco) July 29, 2026, 9:18 a.m. UTC 
From: Hetvi Thakar <hthakar@cisco.com>

This patch applies the upstream fix as referenced in [2], using the
commit shown in [1].

The upstream fix replaces a string eval used to load profile packages
with Module::Load::load. Since Perl core modules are packaged
separately, add perl-module-load to RDEPENDS to provide Module/Load.pm
at runtime.

[1] https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-14380

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
 .../perl/libdbi-perl/CVE-2026-14380.patch     | 37 +++++++++++++++++++
 .../perl/libdbi-perl_1.647.bb                 |  2 +
 2 files changed, 39 insertions(+)
 create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch
diff mbox series

Patch

diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch
new file mode 100644
index 0000000000..844885d936
--- /dev/null
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch
@@ -0,0 +1,37 @@ 
+From 509bbfcff36b1b1e1d81cc3ca435974448b9835c Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Wed, 1 Jul 2026 22:31:56 +0100
+Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380]
+
+CVE: CVE-2026-14380
+Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259]
+
+(cherry picked from commit b73d5d9901767fc1d16b6661ef08fbed4532e259)
+Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
+---
+ lib/DBI/Profile.pm | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm
+index 9b16c53..66f39ec 100644
+--- a/lib/DBI/Profile.pm
++++ b/lib/DBI/Profile.pm
+@@ -679,6 +679,7 @@ use warnings;
+ use Exporter ();
+ use UNIVERSAL ();
+ use Carp;
++use Module::Load ();
+ 
+ use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge);
+ 
+@@ -758,7 +759,9 @@ sub _auto_new {
+         }
+     }
+ 
+-    eval "require $package" if $package; # silently ignores errors
++    eval {
++        Module::Load::load $package if $package; # silently ignores errors
++    };
+     $package ||= $class;
+ 
+     return $package->new(Path => \@Path, @args);
diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
index 5a76924560..a852dc276a 100644
--- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
+++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb
@@ -12,6 +12,7 @@  LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36"
 SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \
            file://CVE-2026-9698.patch \
            file://CVE-2026-10879.patch \
+           file://CVE-2026-14380.patch \
            "
 SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"
 
@@ -41,6 +42,7 @@  RDEPENDS:${PN}:class-target = " \
     perl-module-exporter-heavy \
     perl-module-dynaloader \
     perl-module-io-dir \
+    perl-module-load \
     perl-module-scalar-util \
     perl-module-universal \
 "