Package: release.debian.org
Severity: normal
Tags: trixie moreinfo
X-Debbugs-Cc: perl@packages.debian.org, pkg-perl-maintainers@lists.alioth.debian.org
Control: affects -1 + src:perl
User: release.debian.org@packages.debian.org
Usertags: pu
Hi,
I'm filing this as a pre-notice that we (as in gregoa and ntyni, with
help from carnil) would like to update src:perl and four related packages
in a trixie point update.
The reason is a list of 13 medium or low priority CVEs, see the changelog
below. They are all fixed in sid + forky (though the last batch only
got in forky a week ago with perl_5.42.3-1).
The related packages are libhttp-tiny-perl, libio-compress-perl,
libsocket-perl, and libmodule-cpants-analyse-perl.
The first three packages include newer copies of affected Perl modules
that are also supplied via src:perl. They are set up so that installing
a separately packaged version will override the older version in perl.
This means that we do not want to update src:perl without also updating
the separate packages, otherwise users could accidentally re-introduce
the security vulnerability by installing one of the separate packages.
The fourth package, libmodule-cpants-analyse-perl, has a trivial test-only
regression with one of the Archive-Tar fixes in src:perl. So we need to
update libmodule-cpants-analyse-perl as well to prevent it from starting
to FTBFS in trixie.
Salvatore says that the window for the next trixie update closes this
weekend. It would be nice to make that. If it gets tight, the separate
packages could go in trixie without src:perl, but not the other way
around.
All the updates are ready but need a bit more testing. I hope I can upload
src:perl on Wednesday evening European time, and Gregor says he'll also
be ready with the others by then, if not earlier.
I assume you will want separate trixie-pu bugs for each package.
I hope this one gives you the bigger picture that the others can refer to.
Please let us know if you have any concerns about all of this.
Apologies for the wall of text.
Current changelog follows. I don't expect this to change anymore.
I'm also attaching my current debdiff, and adding
debian/patches/fixes/CVE-2025-15649.diff separately as it has binary
changes not handled well by debdiff.
I'm setting the moreinfo tag for now, and will remove it when I have
uploaded and can confirm (or correct) the debdiff.
To be clear, this is just to give you a feel of the size of this.
Not expecting you to review this before it's final, but feel free to of
course :)
Source: perl
Version: 5.40.1-6+deb13u1
Distribution: trixie
Urgency: medium
Maintainer: Niko Tyni <ntyni@debian.org>
Timestamp: 1788080035
Date: Sun, 30 Aug 2026 11:53:55 +0300
Closes: 1137345 1138854 1138855 1138856 1138858 1138859 1138860 1138863 1138905 1138906 1140152 1141639 1142037
Changes:
perl (5.40.1-6+deb13u1) trixie; urgency=medium
.
* [SECURITY] various upstream fixes:
+ CVE-2026-7017: HTTP::Tiny credential forwarding on redirects.
(Closes: #1141639)
+ CVE-2026-42496: Archive::Tar symlink extraction.
(Closes: #1138860)
+ CVE-2026-42497: Archive::Tar hardlink extraction.
(Closes: #1138859)
+ CVE-2026-12087: Socket: pack_ip_mreq_source() out-of-bounds heap read.
(Closes: #1140152)
+ CVE-2026-13221: silently incorrect regular expression matches.
(Closes: #1142037)
+ CVE-2025-15649: header parsing in IO::Uncompress::Unzip.
(Closes: #1138863)
+ CVE-2026-7010: CRLF-validation in HTTP::Tiny.
(Closes: #1138858)
+ CVE-2026-8376: Buffer overflow in Perl_study_chunk.
(Closes: #1137345)
+ CVE-2026-48959: CPU exhaustion in IO::Uncompress::Unzip.
(Closes: #1138856)
+ CVE-2026-48961: crash in zipdetails.
(Closes: #1138855)
+ CVE-2026-48962: code execution in IO-Compress via output globs.
(Closes: #1138854)
+ CVE-2026-57432: out of bound heap reads in pack() and unpack().
(Closes: #1138905)
+ CVE-2026-57433: signed integer overflow in Storable.
(Closes: #1138906)
Thanks for your work on Debian,