Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-XML-Bare for openSUSE:Factory checked in at 2026-07-23 23:08:22 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-XML-Bare (Old) and /work/SRC/openSUSE:Factory/.perl-XML-Bare.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-XML-Bare" Thu Jul 23 23:08:22 2026 rev:30 rq:1366830 version:0.53 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-XML-Bare/perl-XML-Bare.changes 2024-03-07 18:27:51.617568622 +0100 +++ /work/SRC/openSUSE:Factory/.perl-XML-Bare.new.2004/perl-XML-Bare.changes 2026-07-23 23:08:32.864506686 +0200 @@ -1,0 +2,11 @@ +Mon Jul 20 18:29:37 UTC 2026 - Tina Müller <[email protected]> + +- Add CVE-2026-57074-r1.patch (CVE-2026-57074, bsc#1271637) + +------------------------------------------------------------------- +Mon Jul 20 17:49:38 UTC 2026 - Tina Müller <[email protected]> + +- Add CVE-2026-13401-r1.patch (CVE-2026-13401, bsc#1271640) +- Add cpanspec.yml for overriding spec values + +------------------------------------------------------------------- New: ---- CVE-2026-13401-r1.patch CVE-2026-57074-r1.patch README.md _scmsync.obsinfo build.specials.obscpio cpanspec.yml ----------(New B)---------- New: - Add CVE-2026-13401-r1.patch (CVE-2026-13401, bsc#1271640) - Add cpanspec.yml for overriding spec values New: - Add CVE-2026-57074-r1.patch (CVE-2026-57074, bsc#1271637) ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-XML-Bare.spec ++++++ --- /var/tmp/diff_new_pack.tHENs4/_old 2026-07-23 23:08:35.128585719 +0200 +++ /var/tmp/diff_new_pack.tHENs4/_new 2026-07-23 23:08:35.164586976 +0200 @@ -1,7 +1,7 @@ # # spec file for package perl-XML-Bare # -# Copyright (c) 2013 SUSE LINUX Products GmbH, Nuernberg, Germany. +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -12,21 +12,25 @@ # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. -# Please submit bugfixes or comments via http://bugs.opensuse.org/ +# Please submit bugfixes or comments via https://bugs.opensuse.org/ # +%define cpan_name XML-Bare Name: perl-XML-Bare Version: 0.53 Release: 0 -%define cpan_name XML-Bare -Summary: Minimal XML parser implemented via a C state engine -License: Artistic-1.0 or GPL-1.0+ -Group: Development/Libraries/Perl -Url: http://search.cpan.org/dist/XML-Bare/ -Source: http://www.cpan.org/authors/id/C/CO/CODECHILD/%{cpan_name}-%{version}.tar.gz -Patch0: fix-pointers.diff -BuildRoot: %{_tmppath}/%{name}-%{version}-build +License: Artistic-1.0 OR GPL-1.0-or-later +Summary: Minimal XML parser / schema checker / pretty-printer using C internally +URL: https://metacpan.org/release/%{cpan_name} +Source0: https://cpan.metacpan.org/authors/id/C/CO/CODECHILD/%{cpan_name}-%{version}.tar.gz +Source1: cpanspec.yml +Source100: README.md +# PATCH-FIX-UPSTREAM https://github.com/nanoscopic/perl-XML-Bare/pull/2 +Patch0: CVE-2026-13401-r1.patch +# PATCH-FIX-UPSTREAM https://github.com/nanoscopic/perl-XML-Bare/pull/1 +Patch1: CVE-2026-57074-r1.patch +Patch2: fix-pointers.diff BuildRequires: perl BuildRequires: perl-macros BuildRequires: perl(Test::More) >= 0.94 @@ -49,15 +53,16 @@ expressions. %prep -%autosetup -p1 -n %{cpan_name}-%{version} -find . -type f -print0 | xargs -0 chmod 644 +%autosetup -n %{cpan_name}-%{version} -p1 + +find . -type f ! -path "*/t/*" ! -name "*.pl" ! -path "*/bin/*" ! -path "*/script/*" ! -path "*/scripts/*" ! -name "configure" -print0 | xargs -0 chmod 644 %build -%{__perl} Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}" -%{__make} %{?_smp_mflags} +perl Makefile.PL INSTALLDIRS=vendor OPTIMIZE="%{optflags}" +%make_build %check -%{__make} test +make test %install %perl_make_install @@ -65,6 +70,5 @@ %perl_gen_filelist %files -f %{name}.files -%defattr(-,root,root,755) %doc Changes README ++++++ CVE-2026-13401-r1.patch ++++++ From: CPANSec Security Scanner Bot <[email protected]> Subject: [PATCH] XML::Bare: advance stuck attribute-name state (infinite loop) Infinite loop (CWE-835) in the hand-rolled C parser (parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on untrusted XML. The `att_nameqsdone` state — reached after a single-quoted attribute *name* — loops back to itself without advancing `cpos` on any character other than `=` or NUL, spinning forever in C on malformed input. The parser holds the interpreter for the duration of the call, so no Perl-level signal (`alarm`, etc.) can interrupt it: a single request pins a CPU indefinitely. Triggers: `<a ='c'>`, `<a b='''''''c'>`, `<x y=''''''z'>`. Fix: advance the cursor before looping, so the scan terminates at the next `=` or at the NUL sentinel (already handled by the `case 0` branch). --- a/parser.c +++ b/parser.c @@ -484,6 +485,7 @@ cpos++; goto att_eq1; } + cpos++; // advance the cursor so malformed input (no '=' after a quoted attr name) cannot spin forever goto att_nameqsdone; att_eq1: ++++++ CVE-2026-57074-r1.patch ++++++ From: CPANSec Security Scanner Bot <[email protected]> Subject: [PATCH] XML::Bare: bounds truncated fixed-advance lookahead (heap OOB read) Heap-buffer-overflow READ (CWE-125) in the hand-rolled C parser (parser.c), reached by the default XML::Bare->new(text=>$xml)->parse on untrusted XML. Several transitions advance `cpos` by a fixed amount past a recognised token without checking the buffer end, then dereference the new position: - the `< The current state of perl in the devel project build (devel:languages:perl)  ++++++ _scmsync.obsinfo ++++++ mtime: 1784572197 commit: 1b19042aec0994cb1163175d68806b622f7fdde94f2a137c5ed10af40a4f312c url: https://src.opensuse.org/perl/perl-XML-Bare revision: 1b19042aec0994cb1163175d68806b622f7fdde94f2a137c5ed10af40a4f312c projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-07-20 20:29:57.000000000 +0200 @@ -0,0 +1 @@ +.osc ++++++ cpanspec.yml ++++++ --- #description_paragraphs: 3 #description: |- # override description from CPAN #summary: override summary from CPAN #no_testing: broken upstream #sources: # - source1 # - source2 patches: fix-pointers.diff: -p1 CVE-2026-57074-r1.patch: -p1 PATCH-FIX-UPSTREAM https://github.com/nanoscopic/perl-XML-Bare/pull/1 CVE-2026-13401-r1.patch: -p1 PATCH-FIX-UPSTREAM https://github.com/nanoscopic/perl-XML-Bare/pull/2 # bar.patch: # baz.patch: PATCH-FIX-OPENSUSE #preamble: |- # BuildRequires: gcc-c++ #post_prep: |- # hunspell=`pkg-config --libs hunspell | sed -e 's,-l,,; s, *,,g'` # sed -i -e "s,hunspell-X,$hunspell," t/00-prereq.t Makefile.PL #post_build: |- # rm unused.files #post_install: |- # sed on %{name}.files #license: SUSE-NonFree #skip_noarch: 1 #custom_build: |- #./Build build flags=%{?_smp_mflags} --myflag #custom_test: |- #startserver && make test #ignore_requires: Bizarre::Module #ignore_provides: Module::To::Ignore #skip_doc: regexp_to_skip_for_doc.* #add_doc: files to add to docs #misc: |- #anything else to be added to spec file #follows directly after %files section, so it can contain new blocks or also #changes to %files section #epoch: number # Where module files should be searched for. Default: lib/ #index_dir:
