From patchwork Wed Jul 29 09:18:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 93841 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11063C54F51 for ; Wed, 29 Jul 2026 09:19:10 +0000 (UTC) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7426.1785316740417422150 for ; Wed, 29 Jul 2026 02:19:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=MfDG3hJ8; spf=pass (domain: cisco.com, ip: 173.37.142.88, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3814; q=dns/txt; s=iport01; t=1785316740; x=1786526340; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=bLJ2ArFQwCbuGHCYgibrWiJV5tfrhtcqEixj/UfrytM=; b=MfDG3hJ8ePS6v96TxHkYAuWp93ffOaNLbka/9OeFqcj5kiQQatz9L9ea s1Lw4RAo4iTZZ8W7+yLqJ1BqJfAM/tdLZ6bOkFucBFNK8/STqOw7if1HV fQTQGjYzDreFFD0l593CAeZogVDyq2pGg/KDPYD/XRv1TZcstaXZhwh7K +xSUdB5y6Jkt35MV6E2hx24WBcKyn6w4X/yUJM66fyqlZY4cbYRWjub+E SRfDpR1eKH0fxtFpX/j5M2BPLlOYpzv1wVTX+3KD5rpLwE3CXWUWwpH0H zJM8ZzMLAMginiZCZ02FMfTjZ0ic9c7YUjeGjcjOg9snSCV0NSvoOjXYI Q==; X-CSE-ConnectionGUID: 97CCdzNGRWiFSsRRwrFbcQ== X-CSE-MsgGUID: GWPJlr7zT1agg1Jm3KRWdg== X-IPAS-Result: A0BEAgB8xGlq/5UQJK1aglmCV3ReQ0mVXmyBFp0IgX4PAQEBD0QNBAEBhQWNaAImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBNQFGLAMBAlojIYMCAYJ0AxG+E4IsgQGDWgUJAkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKBFYJzdoEFgVwBAYEnhn4EgiJ6EoFaHpA3SIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4ENGwcFgR2BLD+EVyMZNn+BL3VKdy1pARIXgRqDOQKCQQMLGA1IESw3FBkEPm4HjW8hgkQBgQ4BKyCBZCiTLpJIgTWfWgoog3WMIZU6GjOFW6URmQiOCpYZN4RpgWg8gUcLB3AVgyIJShkPji4KC4NggX+DQgbJEycyCzIBAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:0OAzBK96HgpnKWqrlzIeDrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3z 2EXXDyOaP2NN2Ske98kPN+3pktU75aEmoAwQAU/pX9EQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmE4EzrauS9xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mvyyHjEAX9gWAsbThFs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2lnYqYz9vRRLltx9 NIjMwo3cQqtjemPlefTpulE3qzPLeHiOIcZ/3UlxjbDALN/G9bIQr7B4plT2zJYasJmRKmFI ZFHL2MxKk2cMnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+Oe8boCIJIDaHa25mG63m Vrk+36mEC1DPdOQkBiAqVGWuePAyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJZF+k8rQXIwa3O7kPAXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:kaXaBamL4zoytPLHbavdxpN+0HzpDfIA3DAbv31ZSRFFG/FwWf rAoB19726QtN9/YhAdcLy7VZVoIkmsl6Kdn7NwAV7KZmCP0wGVxepZg7cKrQeNJ8TWzJ846U 4ZSdkcNPTASX5nkM39/A60V/wkwNWB7eSUoN229QYLcemvAJsQljuQzW2gYytLeDU= X-Talos-CUID: 9a23:9rpf32kXTae7jAXY3SUuSXm7j+XXOSyC51zcMWmXM1loZoaOc2WP4o1umPM7zg== X-Talos-MUID: 9a23:rcDCRwmF/T/4wLy1P2lCdnpNC/9K577xGnxUmJoJ4uuBbg9KBDuS2WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,192,1779148800"; d="scan'208";a="796256480" Received: from alln-l-core-12.cisco.com ([173.36.16.149]) by alln-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 29 Jul 2026 09:18:59 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by alln-l-core-12.cisco.com (Postfix) with ESMTPS id 3DDBD1800020B; Wed, 29 Jul 2026 09:18:59 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id CD17FCD1450; Wed, 29 Jul 2026 02:18:58 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [meta-oe][wrynose][PATCH 1/5] libdbi-perl: Fix CVE-2026-9698 Date: Wed, 29 Jul 2026 02:18:36 -0700 Message-Id: <20260729091840.84531-1-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: alln-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 29 Jul 2026 09:19:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128551 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e [2] https://nvd.nist.gov/vuln/detail/CVE-2026-9698 Signed-off-by: Hetvi Thakar --- .../perl/libdbi-perl/CVE-2026-9698.patch | 51 +++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 4 +- 2 files changed, 54 insertions(+), 1 deletion(-) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch new file mode 100644 index 0000000000..83df70de54 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-9698.patch @@ -0,0 +1,51 @@ +From 9a85c9bc1c1fafa42a223d3310f9c5a6305902f0 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Wed, 27 May 2026 11:16:50 +0200 +Subject: [PATCH] Fix possible stack overflow (old issue already noted by Tim) + +CVE: CVE-2026-9698 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e] + +Backport Changes: +- Applied the DBI.xs security fix without functional changes. +- Omitted ChangeLog and lib/DBI/Changes.pm because they contain only + DBI 1.648 release-note updates. +- Omitted dbixs_rev.h because it is generated from upstream Git history + and its hunk depends on DBIXS_RELEASE and DBIXS_VERSION metadata added + after DBI 1.647. The fix does not change the DBIXS or DBISTATE + interface. +- Omitted the Makefile.PL addition that runs dbixs_rev.pl from the doc + target. It only regenerates dbixs_rev.h and is not required to compile + or activate the DBI.xs security fix. + +(cherry picked from commit bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e) +Signed-off-by: Hetvi Thakar +--- + DBI.xs | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index 97d9378..1f06d4d 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4000,7 +4000,6 @@ XS(XS_DBI_dispatch) + SV **statement_svp = NULL; + const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1); + const char *err_meth_name = meth_name; +- char intro[200]; + + if (meth_type == methtype_set_err) { + SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN); +@@ -4008,10 +4007,8 @@ XS(XS_DBI_dispatch) + err_meth_name = SvPV_nolen(*sem_svp); + } + +- /* XXX change to vsprintf into sv directly */ +- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, +- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"); +- msg = sv_2mortal(newSVpv(intro,0)); ++ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, ++ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information")); + if (SvOK(DBIc_ERRSTR(imp_xxh))) + sv_catsv(msg, DBIc_ERRSTR(imp_xxh)); + else diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 00f8181065..f676f73d67 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -9,7 +9,9 @@ SECTION = "libs" LICENSE = "Artistic-1.0 | GPL-1.0-or-later" LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36" -SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz" +SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ + file://CVE-2026-9698.patch \ + " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" S = "${UNPACKDIR}/DBI-${PV}" From patchwork Wed Jul 29 09:18:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 93842 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 110ACC54FCD for ; Wed, 29 Jul 2026 09:19:10 +0000 (UTC) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7430.1785316749018583338 for ; Wed, 29 Jul 2026 02:19:09 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=P/6WwxPY; spf=pass (domain: cisco.com, ip: 173.37.142.91, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3174; q=dns/txt; s=iport01; t=1785316749; x=1786526349; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=mibhsJ0hUQ48FgYtWYGMort54N4XgneR4RysZUCopG8=; b=P/6WwxPYyoLFO4wM4U6TJnzvMtl2nWEgE/L3QdpqoopXAyyh8m6vjJr0 8pC9GN4m0FLqKpf1UnuCB4sFx4w3JWgMQKMjsp4nsR7zSykqlAXpaLoNs F6FY3HjIj8DLJ6rQBctx/zWCAJTaJ4YNcFV3q2KL7Kc2OIavoYZCbWF1e c78/dJ8J7UvYu5Cfcwt9NTXxCp3Zwyb6mkN/F+iO4t8Nd9LTk74rJZIvU T14vUPlNOqSLImj7rr4olGitRxjixAAjtsJo7JahmX+GAXHIZ1hLL8fnm cW2F7SOiI23kbdotWqZZZG74R+7LQzVvPqDCGnOP8qljO57omNtM2a9Sh A==; X-CSE-ConnectionGUID: PQ97elZpQ8mQh9sTeqOBow== X-CSE-MsgGUID: PKmtCotMSAyRyy5bkM7nWA== X-IPAS-Result: A0BHAgB8xGlq/5UQJK1aglmCV3ReQ0kDlVtsA54bgX4PAQEBD0QNBAEBhQUCjWYCJjQJDgECBAMCAwEBAQEBAQEBAQEBCwEBBQEBAQIBBwWBDhOGTw2GWgECAQMyAUYQHAMBAi8rIwgZgwIBgnQDEb4TgiyBAYNoAkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKBFYNpgQWBXAKBJ4Z+BIIiehKBWh6QN0iBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBDRsHBYEdgSw/hFcjGTZ/gS91SnctaQESF4EagzkCgkEDCxgNSBEsNxQZBD5uB41vIYJEAYEOASuCLEulK6EPCiiDdYwhlToaM4VbpRELmH2OCpZQhGmBaDyBWXAVgyIJShkPji0BCguDYIUTNMkTJzILAy8BAQcCBw4DC4FokACBfgEB IronPort-Data: A9a23:v6+CN6Bpo9I53xVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApDMlhDRVn WsaXzjSM/jfY2PyLowlPNvg901Xu8eDz983OVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGdIZvCCeA+n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXmthh fuo+5eBYAD/imYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TE+8w/U0wyD5UhquNOATBVy fEBDxoKcUXW7w626OrTpuhEj8AnKozveYgYoHwllGufBvc9SpeFSKLPjTNa9G5v3YYVQ7CHO YxANWsHgBfoO3WjPn8XFJI3n+6yrnL+aDZf7lmSoMLb5kCMnVQggOe1b4G9ltqifeZQgm2fu kf91nXDEwBHPt+6ljy62yf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTWValrP2Rjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWstxoYXZ9UVuY98gzIk/CS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH69V5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:yD8t1qsasWVcvtzWQ5LdGiHF7skDrtV00zEX/kB9WHVpmwKj+P xG+85rsiMc5wxxZJhNo7290ey7MBHhHP1OkO0s1MmZPDUO0VHAROoJ0WKh+UyEJ8SUzIBgPM lbH5SWIeeAa2SS9fyKgzWQIpIH3MSN9ryuiKP1yndgShwvVoRbhj0Jczpy1iZNNXJ77V1TLu vl2vZ6 X-Talos-CUID: 9a23:MD2WWWj77gtR43Zcxq2/WryMLzJuSkSMk3rUEVeBWWNQSOyOdVKJ34ljjJ87 X-Talos-MUID: 9a23:UzWzjA2sq7r1yUWRF32+FTgnTzUj24erFGsKjbA9kti+JD0tMTS40zKIa9py X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,192,1779148800"; d="scan'208";a="790987073" Received: from alln-l-core-12.cisco.com ([173.36.16.149]) by alln-iport-4.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 29 Jul 2026 09:19:08 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by alln-l-core-12.cisco.com (Postfix) with ESMTPS id 15CDB18000238; Wed, 29 Jul 2026 09:19:08 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id AFB5ECD1450; Wed, 29 Jul 2026 02:19:07 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [meta-oe][wrynose][PATCH 2/5] libdbi-perl: Fix CVE-2026-10879 Date: Wed, 29 Jul 2026 02:18:37 -0700 Message-Id: <20260729091840.84531-2-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260729091840.84531-1-hthakar@cisco.com> References: <20260729091840.84531-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: alln-l-core-12.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 29 Jul 2026 09:19:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128552 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978 [2] https://security-tracker.debian.org/tracker/CVE-2026-10879 Signed-off-by: Hetvi Thakar --- .../perl/libdbi-perl/CVE-2026-10879.patch | 41 +++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 42 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch new file mode 100644 index 0000000000..06668adf07 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-10879.patch @@ -0,0 +1,41 @@ +From 37f2f9149944fa265ea65a8344a9efcdebc0d717 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Thu, 28 May 2026 14:14:50 +0200 +Subject: [PATCH] Replacing `?` with `:p#` in `preparse ()` with more than 9 + `?` causes buffer overflow + +`:p1` is length 3, `?` just 1, but `:p1003` is length 6! + +CVE: CVE-2026-10879 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978] + +Backport Changes: +- Applied the DBI.xs security fix without functional changes. +- Omitted ChangeLog and lib/DBI/Changes.pm because they contain only + DBI 1.648 release-note updates. +- Omitted dbixs_rev.h because it is generated from upstream Git history + and its hunk only updates the generated timestamp and revision. The + fix does not change the DBIXS or DBISTATE interface. +- Omitted doc/DBI.3 and doc/DBI.man because they are generated manual + pages that only contain regenerated dates and are absent from the + DBI 1.647 CPAN source. + +(cherry picked from commit af79036c07aa9a457971c0f4136e37c85dc20978) +Signed-off-by: Hetvi Thakar +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index 1f06d4d..fbfe405 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4203,7 +4203,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + + /* XXX this allocation strategy won't work when we get to more advanced stuff */ +- new_stmt_sv = newSV(strlen(statement) * 3); ++ new_stmt_sv = newSV(strlen(statement) * 6 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index f676f73d67..5a76924560 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -11,6 +11,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36" SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-9698.patch \ + file://CVE-2026-10879.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Wed Jul 29 09:18:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 93843 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5DD1C54F51 for ; Wed, 29 Jul 2026 09:19:19 +0000 (UTC) Received: from alln-iport-1.cisco.com (alln-iport-1.cisco.com [173.37.142.88]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7432.1785316752662374560 for ; Wed, 29 Jul 2026 02:19:12 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=b3zu5Qnp; spf=pass (domain: cisco.com, ip: 173.37.142.88, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=3135; q=dns/txt; s=iport01; t=1785316752; x=1786526352; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=xcPrByut4RzP3lv45qvkv9vrbN3jcozvyd5vVqM3y5A=; b=b3zu5QnpUZIowdT2yg3R5hwYPa9kcHD8CQN60gGYwQmpxZJUwwl6SUk8 nIV3AvJcEwDN19z/kr5b0GcRKiKm3A9esrdSwgE7D+IcFTHXfAz0TTNnH K8FohnpqYtGoZtmyiX/LszQZjo1imOP+or6NU0072h/4niTdF6hZguMLy FnDDtPTieI+F56QfkoXgvaed1g8i9AcEKf7HsBDSfrEK8pH9K/hHubeY1 xfaboTjpAbe3jZ+ZWPHhISvVRaLJZkyuyYnRzxdr0QdIs1L8xm3haTHQC ih15oKtRYd1mqPBSQDmSXiMfjlTu42bzSZrxCKnDUtjiP+roaFa81ENWy w==; X-CSE-ConnectionGUID: NABTDODhRLejXHtslQ1sWg== X-CSE-MsgGUID: rE3dv2nqSlqYTqYC2C4kFw== X-IPAS-Result: A0BHAgB8xGlq/5MQJK1aglmCV3ReQ0mVXmwDnhuBfg8BAQEPRA0EAQGFBQKNZgImNAkOAQIEAwIDAQEBAQEBAQEBAQELAQEFAQEBAgEHBYEOE4ZPDYZaAQIBAycLAUYQHAMBAi8rIwgZgwIBgnQDEb4TgXkzgQGDaAJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FyhAh2gQWBXAEBgSeGfgSCIoEMgVoekDdIgR4DWSwBVRMNCgsHBYFmAzUSKhVuMh2BIz4XgQ0bBwWBHYEsP4RXIxk2f4EvdUp3LWkBEheBGoM5AoJBAwsYDUgRLDcUGQQ+bgeNbyGCRYEOASuBGzUKKZNWkkmhDwoog3WMIZU6GjOFW6URC5h9jgqWUIRpgWg8gUcLB3AVgyIJShkPji4KC4NggX+DSMkTJzILMgEBBwIHDgMLgWiQAIF+AQE IronPort-Data: A9a23:6oYv8KlhiK50LWuAv99Ommzo5gzXJ0RdPkR7XQ2eYbSJt1+Wr1Gzt xJNC2GEPayDZmGnL4wgb9vgp0oGvZfRydBgSgNv+39kFltH+JHPbTi7wugcHM8zwunrFh8PA xA2M4GYRCwMZiaC4E/raf658SUUOZigHtLUEPTDNj16WThqQSIgjQMLs+Mii+aEu/Dha++2k Y20+ZC31GONgWYubDpLsfPb8XuDgdyr0N8mlg1mDRx0lAe2e0k9VPo3Oay3Jn3kdYhYdsbSb /rD1ryw4lTC9B4rDN6/+p6jGqHdauePVeQmoiM+t5mK2nCulARrukoIHKZ0hXNsttm8t4sZJ OOhGnCHYVxB0qXkwIzxWvTDes10FfUuFLTveRBTvSEPpqHLWyOE/hlgMK05Fasx0NpbJk1Oz 9gVKgAtcguHvrut/73uH4GAhux7RCXqFIobvnclyXTSCuwrBMmbBa7L/tRfmjw3g6iiH96HO JFfMmQpNUqGOkEQUrsUIMpWcOOAhmX/ej5RsnqepLE85C7YywkZPL3Fb4uLIIHUG5UE9qqej njrpGjnWBcDD9iG+Aacw1n2rbPMszyuDer+E5X9rJaGmma7wXQeDhATX1a3rfS1z0KzRd9bA 0gV4TY1668q+UqmS9PwUxG1rDiDpBF0ZjZLO+Q+7AfIzu/f5ByUQzFcCDVAc9ch8sQxQFTGy 2O0oj8gPhQ32JX9dJ5X3u38Qe+aUcTNEVI/WA== IronPort-HdrOrdr: A9a23:YWmFG68lNCl6i5lsYY1uk+AAI+orL9Y04lQ7vn2ZhyY7TiX+rb HIoB11737JYVoqNU3I3OrwWpVoIkmskaKdn7NwAV7KZmCP0wGVxcNZnO7fKlbbdREWmNQw6U 5ISdkZNDSJNykYse/KpC+lDt0n3N6LtIqshevY0jNRaDsCUdAY0++8YTzraXGfg2J9dOIEKK Y= X-Talos-CUID: 9a23:C0QaD2DyyOMEqbv6Ew9O3nI4PewlSFnQzkfwP1S8MD9yd7LAHA== X-Talos-MUID: 9a23:k3U7KApdnjX6LNJdRh0ezytPb8t2uaK3M0QUoKkfiuLeHnBzFSjI2Q== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,192,1779148800"; d="scan'208";a="796256689" Received: from alln-l-core-10.cisco.com ([173.36.16.147]) by alln-iport-1.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 29 Jul 2026 09:19:11 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by alln-l-core-10.cisco.com (Postfix) with ESMTPS id C0CF018000254; Wed, 29 Jul 2026 09:19:11 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 9D077CD144F; Wed, 29 Jul 2026 02:19:10 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [meta-oe][wrynose][PATCH 3/5] libdbi-perl: Fix CVE-2026-14380 Date: Wed, 29 Jul 2026 02:18:38 -0700 Message-Id: <20260729091840.84531-3-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260729091840.84531-1-hthakar@cisco.com> References: <20260729091840.84531-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: alln-l-core-10.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 29 Jul 2026 09:19:19 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128553 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. The upstream fix replaces a string eval used to load profile packages with Module::Load::load. Since Perl core modules are packaged separately, add perl-module-load to RDEPENDS to provide Module/Load.pm at runtime. [1] https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-14380 Signed-off-by: Hetvi Thakar --- .../perl/libdbi-perl/CVE-2026-14380.patch | 37 +++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 2 + 2 files changed, 39 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch new file mode 100644 index 0000000000..844885d936 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch @@ -0,0 +1,37 @@ +From 509bbfcff36b1b1e1d81cc3ca435974448b9835c Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Wed, 1 Jul 2026 22:31:56 +0100 +Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380] + +CVE: CVE-2026-14380 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259] + +(cherry picked from commit b73d5d9901767fc1d16b6661ef08fbed4532e259) +Signed-off-by: Hetvi Thakar +--- + lib/DBI/Profile.pm | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm +index 9b16c53..66f39ec 100644 +--- a/lib/DBI/Profile.pm ++++ b/lib/DBI/Profile.pm +@@ -679,6 +679,7 @@ use warnings; + use Exporter (); + use UNIVERSAL (); + use Carp; ++use Module::Load (); + + use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge); + +@@ -758,7 +759,9 @@ sub _auto_new { + } + } + +- eval "require $package" if $package; # silently ignores errors ++ eval { ++ Module::Load::load $package if $package; # silently ignores errors ++ }; + $package ||= $class; + + return $package->new(Path => \@Path, @args); diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 5a76924560..a852dc276a 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36" SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-9698.patch \ file://CVE-2026-10879.patch \ + file://CVE-2026-14380.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" @@ -41,6 +42,7 @@ RDEPENDS:${PN}:class-target = " \ perl-module-exporter-heavy \ perl-module-dynaloader \ perl-module-io-dir \ + perl-module-load \ perl-module-scalar-util \ perl-module-universal \ " From patchwork Wed Jul 29 09:18:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 93844 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01FB8C53200 for ; Wed, 29 Jul 2026 09:19:20 +0000 (UTC) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7433.1785316755279572630 for ; Wed, 29 Jul 2026 02:19:15 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=lea74dU9; spf=pass (domain: cisco.com, ip: 173.37.142.89, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=6160; q=dns/txt; s=iport01; t=1785316755; x=1786526355; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=YqMNQ+lrI8CbFk5eqmuIPHhs4TNjjMrqmwYqtc+LFx0=; b=lea74dU966lF12MX0exJUbJcu/+EoI+1JbCAU3ELhdt4FTa99lZ8eOMG BB6KegGgpJEj/nV0N2R7jdRF62uts+2lT4QYwQAik3IiYIlhSQQ89eNMx naATEIrNB/Of6+pNzjqihhdfeKRH10pUB1EIYK2K6F3abgqnvCXKZUeuq uaScI82DejoW9OPfYnWwiX3sGqtFL1TsM2Q6yWXhwMVsQVNBC85a1DIbu wLUJc+9hcdpq2XkyKnpDpevh9JVAZm5vqqmwRn/KwqKnq4Tu115JxvTWU BWBwXpQdqR2R235Wo8KTQQIijUuKL15gs/SgCv7SXkbKNsqclnUyet8/V g==; X-CSE-ConnectionGUID: hvrvCgxzSD6Bsc49vxpriw== X-CSE-MsgGUID: PQljiHU2SXWzMy/c827j9A== X-IPAS-Result: A0BGAgDMxGlq/48QJK1aglmCV3ReQ0mWSgOeG4F+DwEBAQ9EDQQBAYUFAo1mAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDJwsBRhAcAwECLysjCBmDAgGCdAMRvhSBeTOBAYNoAkNQ2y4BCxQBBYEzhT+IIFwYAYR8JxsbgXKBFYNpgQWBXAEBgS0Lhm0Egg0VehKBWh6QN0iBHgNZLAFVEw0KCwcFgWYDNRIqFW4yHYEjPheBDRsHBYEdgSw/hFcjGTZ/gS91SnctaQESF4EagzkCgkEDCxgNSBEsNxQZBD5uB41vIYJEARYXNisBKQIJgRKBEUuSbQeQFoIhoQ8KKIN1jCGVOhozhVulEQuYfY4KllCEaYFoPIFHCwdwFYMiCUoZD44tCwuDYIF/ggiBQMkTJzILMgEBBwIHDgMLgWiQAYF9AQE IronPort-Data: A9a23:Vi/SEaDlToXGZhVW/3/iw5YqxClBgxIJ4kV8jS/XYbTApGhx1TVRy DQZWWiAbPyKMTeneo10Ydm1/UxQu8WEztdjOVdlrnsFo1CmBibm6XV1Cm+qYkt+++WaFBoPA /02M4eGdIZvCCeA+n9BC5C5xVFkz6aEW7HgP+DNPyF1VGdMRTwo4f5Zs7ZRbrVA357jXmthh fuo+5eBYAD/imYtWo4pw/vrRC1H7ayaVAww5jTSVdgT1HfCmn8cCo4oJK3ZBxPQXolOE+emc P3Ixbe/83mx109F5gSNy+uTnuUiG9Y+DCDW4pZkc/HKbitq+kTe5p0G2M80Mi+7vdkmc+dZk 72hvbToIesg0zaldO41C3G0GAkmVUFKFSOuzXWX6aSuI0P6n3TEw+t0Emo5LZ8j1rhdGmoSp OIIMCoMcUXW7w626OrTpuhEj8AnKozveYgYoHwllW+fBvc9SpeFSKLPjTNa9G5v3YYVQ7CHO YxANWEHgBfoO3WjPn8XFJI3n+6yrnL+aDZf7lmSoMLb5kCMnFwriOW2YIe9ltqiffxRnEe4m zj9z1vrJwBdP4zFljjU2yf57gPItWahMG4IL5W/7vNsjViZy2AfBRFTWValrP2Rjk+lR8kZL FQZ/Ccrp6U++EGnCN7nUHWFTGWstxoYXZ9UVuY98gzIkvSS6AeCDW9CRTlEADA7iPILqfUR/ gfht7vU6fZH4dV5lVr1Gm+okA6P IronPort-HdrOrdr: A9a23:Affj5aFVxtpuwveqpLqEMMeALOsnbusQ8zAXPo5KJiC9Ffbo8P xG88576faZslsssTQb6LK90cq7MBfhHOBOgbX5VI3KNGKNhILrFvAG0WKI+VPd8kPFmtK1/J 0QFZSWcOeAbmRSvILd/BSyFcomzZ2s9aClgvqb8lJWJDsaEp2JK2xCe32m+oocfng/OaYE X-Talos-CUID: 9a23:Ok/WsWDEzI/3WXn6Eyl57lA/FdA3SVGD5mzbfx6mGX5zSaLAHA== X-Talos-MUID: 9a23:f4nwJAnSz1CTihf+XP6qdnpaDcNq4oSTUns9rocjqo6PZXYvOWa02WE= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,192,1779148800"; d="scan'208";a="788205385" Received: from alln-l-core-06.cisco.com ([173.36.16.143]) by alln-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 29 Jul 2026 09:19:14 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by alln-l-core-06.cisco.com (Postfix) with ESMTPS id 022781800059E; Wed, 29 Jul 2026 09:19:14 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id 94946CD144F; Wed, 29 Jul 2026 02:19:13 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [meta-oe][wrynose][PATCH 4/5] libdbi-perl: Fix CVE-2026-14739 Date: Wed, 29 Jul 2026 02:18:39 -0700 Message-Id: <20260729091840.84531-4-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260729091840.84531-1-hthakar@cisco.com> References: <20260729091840.84531-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: alln-l-core-06.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 29 Jul 2026 09:19:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128554 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-14739 Signed-off-by: Hetvi Thakar --- .../perl/libdbi-perl/CVE-2026-14739.patch | 124 ++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 125 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch new file mode 100644 index 0000000000..84d8b8391a --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14739.patch @@ -0,0 +1,124 @@ +From 99798054e18bc9653ce0e29b2de90288981b4ad4 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Sat, 4 Jul 2026 11:38:24 +0200 +Subject: [PATCH] Set a hard limit of 99999 on '?' placeholders + (CVE-2026-14739) + +CVE: CVE-2026-14739 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395] + +Backport Changes: +- Applied the complete DBI.xs security fix without functional changes. + This patch follows CVE-2026-10879 because the upstream fix updates + that earlier fix's buffer allocation and adds the 99,999-placeholder + limit. +- Omitted ChangeLog and lib/DBI/Changes.pm because they contain only + DBI 1.650 release-note updates. +- Omitted dbixs_rev.h because it is generated from upstream Git history. + The fix does not change the DBIXS or DBISTATE interface. +- Omitted DBI.pm because its upstream hunks only bump the package from + 1.649 to 1.650 and document the new placeholder limit; they do not + compile or activate the DBI.xs security fix. +- Omitted generated doc/DBI.3, doc/DBI.html, doc/DBI.man, and doc/DBI.md + because they only reproduce the DBI.pm version and documentation + changes and are absent from the DBI 1.647 CPAN source. + +(cherry picked from commit 2b77c88b655e9539a592c71a61fb965fc0075395) +Signed-off-by: Hetvi Thakar +--- + DBI.xs | 53 +++++++++++++++++++++++++++++++++-------------------- + 1 file changed, 33 insertions(+), 20 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index fbfe405..0f9ea9c 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4203,7 +4203,14 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + + /* XXX this allocation strategy won't work when we get to more advanced stuff */ +- new_stmt_sv = newSV(strlen(statement) * 6 + 16); ++ /* The 7 is for length increase from '?' (length 1) to :p99999 (length 7) ++ * which imposes a limit of 99999 '?' placeholders POSIX style. Actual counts ++ * are a bit higher: ++ * using factor 5: :p1 .. :p1107 ++ * using factor 6: :p1 .. :p11106 ++ * using factor 7: :p1 .. :p111105 ++ * and that count is insane already */ ++ new_stmt_sv = newSV(strlen(statement) * 7 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); +@@ -4342,9 +4349,9 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + continue; + } + +- if ( !(*src==':' && (PS_accept(DBIpp_ph_cn) || PS_accept(DBIpp_ph_cs))) +- && !(*src=='?' && PS_accept(DBIpp_ph_qm)) +- ){ ++ if ( !(*src==':' && (PS_accept(DBIpp_ph_cn) || PS_accept(DBIpp_ph_cs))) ++ && !(*src=='?' && PS_accept(DBIpp_ph_qm)) ++ ){ + if (*src == '\'' || *src == '"') + in_quote = *src; + *dest++ = *src++; +@@ -4363,12 +4370,18 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + if (PS_return(DBIpp_ph_qm)) + ; + else if (PS_return(DBIpp_ph_cn)) { /* '?' -> ':p1' (etc) */ ++ if (idx >= 99999) { ++ char buf[99]; ++ sprintf(buf, "preparse found more than 99999 '?' placeholders. Limit exceeded."); ++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); ++ return &PL_sv_undef; ++ } + sprintf(start,":p%d", idx++); + dest = start+strlen(start); + } + else if (PS_return(DBIpp_ph_sp)) { /* '?' -> '%s' */ +- *start = '%'; +- *dest++ = 's'; ++ *start = '%'; ++ *dest++ = 's'; + } + } + else if (isDIGIT(*src)) { /* :1 */ +@@ -4376,24 +4389,24 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + style = ":1"; + + if (PS_return(DBIpp_ph_cn)) { /* ':1'->':p1' */ +- idx = pln; +- *dest++ = 'p'; +- while(isDIGIT(*src)) +- *dest++ = *src++; ++ idx = pln; ++ *dest++ = 'p'; ++ while(isDIGIT(*src)) ++ *dest++ = *src++; + } + else if (PS_return(DBIpp_ph_qm) /* ':1' -> '?' */ + || PS_return(DBIpp_ph_sp) /* ':1' -> '%s' */ + ) { +- PS_return(DBIpp_ph_qm) ? sprintf(start,"?") : sprintf(start,"%%s"); +- dest = start + strlen(start); +- if (pln != idx) { +- char buf[99]; +- sprintf(buf, "preparse found placeholder :%d out of sequence, expected :%d", pln, idx); +- set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); +- return &PL_sv_undef; +- } +- while(isDIGIT(*src)) src++; +- idx++; ++ PS_return(DBIpp_ph_qm) ? sprintf(start,"?") : sprintf(start,"%%s"); ++ dest = start + strlen(start); ++ if (pln != idx) { ++ char buf[99]; ++ sprintf(buf, "preparse found placeholder :%d out of sequence, expected :%d", pln, idx); ++ set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse"); ++ return &PL_sv_undef; ++ } ++ while(isDIGIT(*src)) src++; ++ idx++; + } + } + else if (isALNUM(*src)) /* :name */ diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index a852dc276a..688b63d534 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -13,6 +13,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-9698.patch \ file://CVE-2026-10879.patch \ file://CVE-2026-14380.patch \ + file://CVE-2026-14739.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" From patchwork Wed Jul 29 09:18:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" X-Patchwork-Id: 93845 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 126BFC54F52 for ; Wed, 29 Jul 2026 09:19:20 +0000 (UTC) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.7433.1785316755279572630 for ; Wed, 29 Jul 2026 02:19:16 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: message contains an insecure body length tag" header.i=@cisco.com header.s=iport01 header.b=kTBWLD8b; spf=pass (domain: cisco.com, ip: 173.37.142.89, mailfrom: hthakar@cisco.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.com; i=@cisco.com; l=2859; q=dns/txt; s=iport01; t=1785316756; x=1786526356; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=KOofz2zcevuoCGJA8fa5+3ijF8hpMafkdojey5MDlmQ=; b=kTBWLD8bdGMETR6G1L4pm/HOWGqDyL0cru8dTGpZfTj0AW6gaPfp9NUI +5wpT0WJjB6TDwlqSF7QWDlXPC6tHYKBNoMLiAo0SrZdrDUCogOa4L1pN w92IqLkHTjJpmMkKuYR2duoz56XrINh7QYCW42tGknsQGhcboc15sRDp8 LyMR8NQG3KLHOK3fidlsPwO96OAPk+3nDOUsye5WwkXSX/ePSklyxfR4E rh6g19YkMzCM/JignBdWn7e0hGO350WHepwOmQAvZt/uCvt/9uc1JsPq0 cRJJMapJnTRVMDDiNmrE0yA/lrIXt9HDv5XTnfzez0FEwQsQ7Axe1Jo5+ g==; X-CSE-ConnectionGUID: RMGs0M1ZReW2d1JpL4w/KA== X-CSE-MsgGUID: 5YoNtYZZQUmL0MCwLYcLww== X-IPAS-Result: A0BGAgDMxGlq/4sQJK1aglmCV3ReQ0mWSgOeG4F+DwEBAQ9EDQQBAYUFAo1mAiY0CQ4BAgQDAgMBAQEBAQEBAQEBAQsBAQUBAQECAQcFgQ4Thk8NhloBAgEDMgFGEBwDAQIvKyMIGYMCAYJ0AxG+FIIsgQGDaAJDUNsuAQsUAQWBM4U/iCBcGAGEfCcbG4FyhH6BBYFcAQGBJ4EGhXgEgiJ6EoFaHpA3SIEeA1ksAVUTDQoLBwWBZgM1EioVbjIdgSM+F4ENGwcFgR2BLD+EVyMZNn+BL3VKdy1pARIXgRqDOQKCQQMLGA1IESw3FBkEPm4HjW8hgkWBDgErf6cjoQ8KKIN1jCGPQoV4GjOEBJQXklELmH2OCpZQhGmBaDyBRwsHcBWDIglKGQ+OLQsLg2CBf8xbJzILMgEBBwIHDgMLgWiQAIEeYAEB IronPort-Data: A9a23:XhWmXa8bEbR09jW0hfT5DrUD1n+TJUtcMsCJ2f8bNWPcYEJGY0x3y WVJDzrQMvmNZDHzeooiaY638hwP68OGm9BlGgQ5rHpEQiMRo6IpJzg2wmQcns+2BpeeJK6yx 5xGMrEsFOhtEDmE4EzrauS9xZVF/fngbqLmD+LZMTxGSwZhSSMw4TpugOdRbrRA2bBVOCvT/ 4mvyyHjEAX9gWAsbThFs/vrRC5H5ZwehhtJ5jTSWtgT1LPuvyF9JI4SI6i3M0z5TuF8dsamR /zOxa2O5WjQ+REgELuNyt4XpWVTH9Y+lSDX4pZnc/DKbipq/0Te4Y5nXBYoUnq7vh3S9zxHJ HqhgrTrIeshFvWkdO3wyHC0GQkmVUFN0OevzXRSLaV/wmWeG0YAzcmCA2kMGKIDosMuM1tDy qYUcRIVSkycwMGflefTpulE3qzPLeHiOIcZ/3UlxjbDALN+G9bIQr7B4plT2zJYasJmRKmFI ZFHL2MxKk2bMnWjOX9PYH46tOe0hnD8eidwo1OOrq1x6G/WpOB0+Oe9YICNJ4DQHq25mG7Fl 2Xg41XLMCgnMfjH7BGa1kOnovDQyHaTtIU6UefQGuRRqFqLy2oeDRcbWVe2rby1h1CzX/pbK lcI4WwptaU0+UmhQ9XxUhH+p2SL1iPwQPJZF+k8rQXIwa3O7kPBXC4PTyVKb5ots8peqSEW6 2JlVujBXVRH2IB5g1rGnltIhVte4RQoEFI= IronPort-HdrOrdr: A9a23:PbIeW64iUMSpU6YlXAPXwBDXdLJyesId70hD6qm+c3Nom6uj5q eTdZsgtCMc5Ax9ZJhko6HjBEDiewK5yXcK2+ks1N6ZNWGM0ldAbrsSiLcKqAePJ8SRzIJgPI 5bAs5D4aXLfDtHpPe/xhWkGNA9x9TC2qWpieDCi0pJd2hRGthdB8MTMHfhLqWwLzM2faYEKA == X-Talos-CUID: 9a23:BrpnvG3gBrHDPwRHoj/MarxfIOUKaSX4lUXqLnDiBT9LUJnJVhiz0fYx X-Talos-MUID: 9a23:2k0Aog4w3fsu32tiYgJWlYTHxow10qOIFHE/o6w7vu3cEAdvHwaWqCuoF9o= X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="6.25,192,1779148800"; d="scan'208";a="788205423" Received: from alln-l-core-02.cisco.com ([173.36.16.139]) by alln-iport-2.cisco.com with ESMTP/TLS/TLS_AES_256_GCM_SHA384; 29 Jul 2026 09:19:16 +0000 Received: from sjc-ads-5245.cisco.com (sjc-ads-5245.cisco.com [10.28.23.9]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by alln-l-core-02.cisco.com (Postfix) with ESMTPS id 28F49180001BF; Wed, 29 Jul 2026 09:19:16 +0000 (GMT) Received: by sjc-ads-5245.cisco.com (Postfix, from userid 1887505) id BC55DCD144F; Wed, 29 Jul 2026 02:19:15 -0700 (PDT) From: "Hetvi Thakar -X (hthakar - E INFOCHIPS PRIVATE LIMITED at Cisco)" To: openembedded-devel@lists.openembedded.org Cc: xe-linux-external@cisco.com, Hetvi Thakar Subject: [meta-oe][wrynose][PATCH 5/5] libdbi-perl: Fix CVE-2026-14740 Date: Wed, 29 Jul 2026 02:18:40 -0700 Message-Id: <20260729091840.84531-5-hthakar@cisco.com> X-Mailer: git-send-email 2.35.6 In-Reply-To: <20260729091840.84531-1-hthakar@cisco.com> References: <20260729091840.84531-1-hthakar@cisco.com> MIME-Version: 1.0 X-Auto-Response-Suppress: DR, OOF, AutoReply X-Outbound-Client-TLS: ANONYMOUS;sjc-ads-5245.cisco.com [10.28.23.9];TLSv1.3;TLS_AES_256_GCM_SHA384;256 X-Outbound-SMTP-Client: 10.28.23.9, sjc-ads-5245.cisco.com X-Outbound-Node: alln-l-core-02.cisco.com List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 29 Jul 2026 09:19:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-devel/message/128555 From: Hetvi Thakar This patch applies the upstream fix as referenced in [2], using the commit shown in [1]. [1] https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01 [2] https://nvd.nist.gov/vuln/detail/CVE-2026-14740 Signed-off-by: Hetvi Thakar --- .../perl/libdbi-perl/CVE-2026-14740.patch | 39 +++++++++++++++++++ .../perl/libdbi-perl_1.647.bb | 1 + 2 files changed, 40 insertions(+) create mode 100644 meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch new file mode 100644 index 0000000000..9118bcf633 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14740.patch @@ -0,0 +1,39 @@ +From 65a5eecd6845ed1c29ede9bbe0b651fa3ba3cc2d Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Sat, 4 Jul 2026 10:49:42 +0100 +Subject: [PATCH] Fix out-of-bounds read in preparse when an initial comment is + deleted + +This fixes CVE-2026-14740 + +CVE: CVE-2026-14740 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01] + +Co-Authored-By: Claude Opus 4.8 (1M context) + +Signed-off-by: Robert Rothenberg +(cherry picked from commit fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01) +Signed-off-by: Hetvi Thakar +--- + DBI.xs | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index 0f9ea9c..da5d137 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4239,7 +4239,13 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + if (in_comment == '/') + src++; +- src += (*src != '\n' || *(dest-1)=='\n') ? 1 : 0; ++ /* Only inspect the previously-emitted byte if one exists; ++ when an initial line comment is deleted, dest is still at ++ the start of the output buffer and *(dest-1) would read ++ one byte before it (OOB read). */ ++ src += (*src != '\n' ++ || (dest > SvPVX(new_stmt_sv) && *(dest-1)=='\n')) ++ ? 1 : 0; + in_comment = '\0'; + rt_comment = '\0'; + } diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 688b63d534..883827e270 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -14,6 +14,7 @@ SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-10879.patch \ file://CVE-2026-14380.patch \ file://CVE-2026-14739.patch \ + file://CVE-2026-14740.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa"