diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch new file mode 100644 index 0000000000..eae236527e --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch @@ -0,0 +1,37 @@ +From b588d38661f00361bcf62b2665905ade844866ee Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Wed, 1 Jul 2026 22:31:56 +0100 +Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380] + +CVE: CVE-2026-14380 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259] + +(cherry picked from commit b73d5d9901767fc1d16b6661ef08fbed4532e259) +Signed-off-by: Hetvi Thakar +--- + lib/DBI/Profile.pm | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm +index f2cc886..4188462 100644 +--- a/lib/DBI/Profile.pm ++++ b/lib/DBI/Profile.pm +@@ -679,6 +679,7 @@ use vars qw(@ISA @EXPORT @EXPORT_OK $VERSION); + use Exporter (); + use UNIVERSAL (); + use Carp; ++use Module::Load (); + + use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge); + +@@ -758,7 +759,9 @@ sub _auto_new { + } + } + +- eval "require $package" if $package; # silently ignores errors ++ eval { ++ Module::Load::load $package if $package; # silently ignores errors ++ }; + $package ||= $class; + + return $package->new(Path => \@Path, @args); diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch new file mode 100644 index 0000000000..5ec8c76ee0 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch @@ -0,0 +1,65 @@ +From 54d3e792a236385930e387b28b6c8be779b8d7f7 Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Wed, 1 Jul 2026 23:03:34 +0100 +Subject: [PATCH] Add tests for CVE-2026-14380 + +CVE: CVE-2026-14380 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8] + +(cherry picked from commit d982411aec73b3acfc4e9e465358bca9eb7fede8) +Signed-off-by: Hetvi Thakar +--- + t/40profile.t | 38 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 38 insertions(+) + +diff --git a/t/40profile.t b/t/40profile.t +index 7a71b8f..5c72449 100644 +--- a/t/40profile.t ++++ b/t/40profile.t +@@ -458,8 +458,46 @@ is("@$totals", "27.00 2.93 0.11 0.01 0.23 1023110000.00 1023110010.00", + 'merged time foo/bar'); + is($total_time, 2.93, 'merged nodes foo/bar time'); + ++subtest "CVE-2026-14380" => sub { ++ ++ { ++ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1); ++ local $ENV{DBI_PROFILE} = payload_for($marker); ++ my $dbh = eval { ++ DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 }) ++ }; ++ ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload"; ++ } ++ ++ { ++ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1); ++ my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 }); ++ eval { ++ $dbh->{Profile} = payload_for($marker); ++ }; ++ ok !( -e "/tmp/$marker" ), "Set Profile payload"; ++ } ++ ++ { ++ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1); ++ my $payload = payload_for($marker); ++ my $dsn = "dbi:Sponge(Profile=>$payload):"; ++ my $dbh = eval { ++ DBI->connect($dsn, "", "", { RaiseError => 0 }) ++ }; ++ ok !( -e "/tmp/$marker" ), "DSN payload"; ++ } ++ ++}; ++ + exit 0; + ++sub payload_for { ++ my ($marker) = @_; ++ # Single-quoted q{...} so \x2f is literal backslash-x-2-f for split; ++ # the inner qq(...) re-interprets \x2f = / at eval-time. ++ return qq{2/system(qq(touch \\x2ftmp\\x2f$marker))}; ++} + + sub sanitize_tree { + my $data = shift; diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch new file mode 100644 index 0000000000..c88f829bd7 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch @@ -0,0 +1,27 @@ +From cbd61112415aaa9db84d1af6d0bb3d0f61de8ce0 Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Sat, 4 Jul 2026 13:34:20 +0100 +Subject: [PATCH] t/40profile.t increase number of tests in the plan + +CVE: CVE-2026-14380 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0] + +(cherry picked from commit f94685f415b08ea4b1f183d48430c4583c1c07d0) +Signed-off-by: Hetvi Thakar +--- + t/40profile.t | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/t/40profile.t b/t/40profile.t +index d736da7..ba24421 100644 +--- a/t/40profile.t ++++ b/t/40profile.t +@@ -31,7 +31,7 @@ BEGIN { + if $Config{osvers} =~ /xen/ # eg 2.6.18-4-xen-amd64 + and $ENV{AUTOMATED_TESTING}; + +- plan tests => 60; ++ plan tests => 61; + } + + $Data::Dumper::Indent = 1; diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch new file mode 100644 index 0000000000..90270e155c --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch @@ -0,0 +1,56 @@ +From ef28126fbb8d918307b4995030028984ff8796f5 Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Mon, 6 Jul 2026 09:13:26 +0100 +Subject: [PATCH] Improve CVE-2026-14380 tests for Profile + +CVE: CVE-2026-14380 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200] + +(cherry picked from commit 7949e551b3c7a8854926b6de84f6cc2ceafb2200) +Signed-off-by: Hetvi Thakar +--- + t/40profile.t | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/t/40profile.t b/t/40profile.t +index 5c72449..d736da7 100644 +--- a/t/40profile.t ++++ b/t/40profile.t +@@ -461,31 +461,34 @@ is($total_time, 2.93, 'merged nodes foo/bar time'); + subtest "CVE-2026-14380" => sub { + + { +- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1); ++ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 1); + local $ENV{DBI_PROFILE} = payload_for($marker); + my $dbh = eval { + DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 }) + }; + ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload"; ++ unlink "/tmp/$marker" if -e "/tmp/$marker"; + } + + { +- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1); ++ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 2); + my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 }); + eval { + $dbh->{Profile} = payload_for($marker); + }; + ok !( -e "/tmp/$marker" ), "Set Profile payload"; ++ unlink "/tmp/$marker" if -e "/tmp/$marker"; + } + + { +- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1); ++ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 3); + my $payload = payload_for($marker); + my $dsn = "dbi:Sponge(Profile=>$payload):"; + my $dbh = eval { + DBI->connect($dsn, "", "", { RaiseError => 0 }) + }; + ok !( -e "/tmp/$marker" ), "DSN payload"; ++ unlink "/tmp/$marker" if -e "/tmp/$marker"; + } + + }; diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.643.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.643.bb index 99e8c209fe..c604e46334 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.643.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.643.bb @@ -13,6 +13,10 @@ SRC_URI = "http://search.cpan.org/CPAN/authors/id/T/TI/TIMB/DBI-${PV}.tar.gz \ file://CVE-2014-10402.patch \ file://CVE-2026-9698.patch \ file://CVE-2026-10879.patch \ + file://CVE-2026-14380_p1.patch \ + file://CVE-2026-14380_p2.patch \ + file://CVE-2026-14380_p3.patch \ + file://CVE-2026-14380_p4.patch \ " SRC_URI[md5sum] = "352f80b1e23769c116082a90905d7398" SRC_URI[sha256sum] = "8a2b993db560a2c373c174ee976a51027dd780ec766ae17620c20393d2e836fa" @@ -43,6 +47,7 @@ RDEPENDS:${PN}:class-target = " \ perl-module-exporter-heavy \ perl-module-dynaloader \ perl-module-io-dir \ + perl-module-load \ perl-module-scalar-util \ perl-module-universal \ "