Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Authen-SASL for
openSUSE:Factory checked in at 2026-09-09 16:18:54
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Authen-SASL (Old)
and /work/SRC/openSUSE:Factory/.perl-Authen-SASL.new.1265 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Authen-SASL"
Wed Sep 9 16:18:54 2026 rev:33 rq:1376335 version:2.210.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Authen-SASL/perl-Authen-SASL.changes
2026-02-12 17:26:21.532724433 +0100
+++
/work/SRC/openSUSE:Factory/.perl-Authen-SASL.new.1265/perl-Authen-SASL.changes
2026-09-09 16:21:14.632257663 +0200
@@ -1,0 +2,13 @@
+Mon Sep 7 10:19:22 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 2.210.0 (2.2100)
+ see /usr/share/doc/packages/perl-Authen-SASL/Changes
+
+
+ 2.2100 2026-09-06
+ [Security fixes]
+ - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGEST_MD5
+ Thanks to TIMLEGGE (@timlegge) and the CPANSec team for the
+ AI-assisted detection and fix!
+
+-------------------------------------------------------------------
Old:
----
Authen-SASL-2.2000.tar.gz
New:
----
Authen-SASL-2.2100.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Authen-SASL.spec ++++++
--- /var/tmp/diff_new_pack.ilv4Kp/_old 2026-09-09 16:21:15.371288458 +0200
+++ /var/tmp/diff_new_pack.ilv4Kp/_new 2026-09-09 16:21:15.373288542 +0200
@@ -18,10 +18,10 @@
%define cpan_name Authen-SASL
Name: perl-Authen-SASL
-Version: 2.200.0
+Version: 2.210.0
Release: 0
-# 2.2000 -> normalize -> 2.200.0
-%define cpan_version 2.2000
+# 2.2100 -> normalize -> 2.210.0
+%define cpan_version 2.2100
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: SASL Authentication framework
URL: https://metacpan.org/release/%{cpan_name}
++++++ Authen-SASL-2.2000.tar.gz -> Authen-SASL-2.2100.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/Changes
new/Authen-SASL-2.2100/Changes
--- old/Authen-SASL-2.2000/Changes 2026-01-28 23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/Changes 2026-09-06 18:43:50.000000000 +0200
@@ -1,4 +1,11 @@
+
+2.2100 2026-09-06
+ [Security fixes]
+ - CVE-2026-86219: Replay attack in Authen::SASL::Perl::DIGEST_MD5
+ Thanks to TIMLEGGE (@timlegge) and the CPANSec team for the
+ AI-assisted detection and fix!
+
2.2000 2026-01-28
[Added]
- Documentation for the security layer
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/META.json
new/Authen-SASL-2.2100/META.json
--- old/Authen-SASL-2.2000/META.json 2026-01-28 23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/META.json 2026-09-06 18:43:50.000000000 +0200
@@ -48,58 +48,58 @@
"provides" : {
"Authen::SASL" : {
"file" : "lib/Authen/SASL.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::CRAM_MD5" : {
"file" : "lib/Authen/SASL/CRAM_MD5.pm",
- "version" : "2.2000",
+ "version" : "2.2100",
"x_deprecated" : 1
},
"Authen::SASL::EXTERNAL" : {
"file" : "lib/Authen/SASL/EXTERNAL.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl" : {
"file" : "lib/Authen/SASL/Perl.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::ANONYMOUS" : {
"file" : "lib/Authen/SASL/Perl/ANONYMOUS.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::CRAM_MD5" : {
"file" : "lib/Authen/SASL/Perl/CRAM_MD5.pm",
- "version" : "2.2000",
+ "version" : "2.2100",
"x_deprecated" : 1
},
"Authen::SASL::Perl::DIGEST_MD5" : {
"file" : "lib/Authen/SASL/Perl/DIGEST_MD5.pm",
- "version" : "2.2000",
+ "version" : "2.2100",
"x_deprecated" : 1
},
"Authen::SASL::Perl::EXTERNAL" : {
"file" : "lib/Authen/SASL/Perl/EXTERNAL.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::GSSAPI" : {
"file" : "lib/Authen/SASL/Perl/GSSAPI.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::LOGIN" : {
"file" : "lib/Authen/SASL/Perl/LOGIN.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::OAUTHBEARER" : {
"file" : "lib/Authen/SASL/Perl/OAUTHBEARER.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::PLAIN" : {
"file" : "lib/Authen/SASL/Perl/PLAIN.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
},
"Authen::SASL::Perl::XOAUTH2" : {
"file" : "lib/Authen/SASL/Perl/XOAUTH2.pm",
- "version" : "2.2000"
+ "version" : "2.2100"
}
},
"release_status" : "stable",
@@ -114,7 +114,7 @@
"web" : "https://github.com/perl-authen-sasl/perl-authen-sasl/";
}
},
- "version" : "2.2000",
+ "version" : "2.2100",
"x_contributors" : [
"Aditya Garg <[email protected]>",
"Chris Ridd <[email protected]>",
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/META.yml
new/Authen-SASL-2.2100/META.yml
--- old/Authen-SASL-2.2000/META.yml 2026-01-28 23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/META.yml 2026-09-06 18:43:50.000000000 +0200
@@ -20,46 +20,46 @@
provides:
Authen::SASL:
file: lib/Authen/SASL.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::CRAM_MD5:
file: lib/Authen/SASL/CRAM_MD5.pm
- version: '2.2000'
+ version: '2.2100'
x_deprecated: 1
Authen::SASL::EXTERNAL:
file: lib/Authen/SASL/EXTERNAL.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl:
file: lib/Authen/SASL/Perl.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::ANONYMOUS:
file: lib/Authen/SASL/Perl/ANONYMOUS.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::CRAM_MD5:
file: lib/Authen/SASL/Perl/CRAM_MD5.pm
- version: '2.2000'
+ version: '2.2100'
x_deprecated: 1
Authen::SASL::Perl::DIGEST_MD5:
file: lib/Authen/SASL/Perl/DIGEST_MD5.pm
- version: '2.2000'
+ version: '2.2100'
x_deprecated: 1
Authen::SASL::Perl::EXTERNAL:
file: lib/Authen/SASL/Perl/EXTERNAL.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::GSSAPI:
file: lib/Authen/SASL/Perl/GSSAPI.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::LOGIN:
file: lib/Authen/SASL/Perl/LOGIN.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::OAUTHBEARER:
file: lib/Authen/SASL/Perl/OAUTHBEARER.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::PLAIN:
file: lib/Authen/SASL/Perl/PLAIN.pm
- version: '2.2000'
+ version: '2.2100'
Authen::SASL::Perl::XOAUTH2:
file: lib/Authen/SASL/Perl/XOAUTH2.pm
- version: '2.2000'
+ version: '2.2100'
recommends:
GSSAPI: '0'
requires:
@@ -70,7 +70,7 @@
bugtracker: https://github.com/perl-authen-sasl/perl-authen-sasl/issues
homepage: https://github.com/perl-authen-sasl/perl-authen-sasl/
repository: git://github.com/perl-authen-sasl/perl-authen-sasl.git
-version: '2.2000'
+version: '2.2100'
x_contributors:
- 'Aditya Garg <[email protected]>'
- 'Chris Ridd <[email protected]>'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/Makefile.PL
new/Authen-SASL-2.2100/Makefile.PL
--- old/Authen-SASL-2.2000/Makefile.PL 2026-01-28 23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/Makefile.PL 2026-09-06 18:43:50.000000000 +0200
@@ -26,7 +26,7 @@
"Test::Pod" => 0,
"Test::Pod::Coverage" => 0
},
- "VERSION" => "2.2000",
+ "VERSION" => "2.2100",
"test" => {
"TESTS" => "t/*.t t/negotiations/*.t t/server/*.t"
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/dist.ini
new/Authen-SASL-2.2100/dist.ini
--- old/Authen-SASL-2.2000/dist.ini 2026-01-28 23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/dist.ini 2026-09-06 18:43:50.000000000 +0200
@@ -1,6 +1,6 @@
name = Authen-SASL
abstract = SASL Authentication framework
-version = 2.2000
+version = 2.2100
author = Graham Barr <[email protected]>
author = Erik Huelsmann <[email protected]>
copyright_holder = Graham Barr <[email protected]>
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/CRAM_MD5.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/CRAM_MD5.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/CRAM_MD5.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/CRAM_MD5.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::CRAM_MD5 2.2000;
+package Authen::SASL::CRAM_MD5 2.2100;
use strict;
use warnings;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/EXTERNAL.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/EXTERNAL.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/EXTERNAL.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/EXTERNAL.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::EXTERNAL 2.2000;
+package Authen::SASL::EXTERNAL 2.2100;
use strict;
use warnings;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/ANONYMOUS.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/ANONYMOUS.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/ANONYMOUS.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/ANONYMOUS.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::ANONYMOUS 2.2000;
+package Authen::SASL::Perl::ANONYMOUS 2.2100;
use strict;
use warnings;
@@ -40,7 +40,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/CRAM_MD5.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/CRAM_MD5.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/CRAM_MD5.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/CRAM_MD5.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::CRAM_MD5 2.2000;
+package Authen::SASL::Perl::CRAM_MD5 2.2100;
use strict;
use warnings;
@@ -53,7 +53,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/DIGEST_MD5.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/DIGEST_MD5.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/DIGEST_MD5.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/DIGEST_MD5.pm 2026-09-06
18:43:50.000000000 +0200
@@ -5,7 +5,7 @@
# See http://www.ietf.org/rfc/rfc2831.txt for details
-package Authen::SASL::Perl::DIGEST_MD5 2.2000;
+package Authen::SASL::Perl::DIGEST_MD5 2.2100;
use strict;
use warnings;
@@ -408,6 +408,16 @@
return $cb->();
}
+ # RFC 2831 section 2.1.2: the nonce in the digest-response is "the
+ # server-specified data string received in the preceding digest-challenge".
+ # The replay resistance of section 3.3 rests on the server binding the
+ # response to the nonce it issued, so check that before anything else uses
+ # the client-supplied value.
+ unless (defined $self->{nonce} and $cparams{nonce} eq $self->{nonce}) {
+ $self->set_error("nonce does not match the one issued");
+ return $cb->();
+ }
+
my $count = hex ($cparams{'nc'} || 0);
unless ($count == ++$self->{nonce_counts}{$cparams{nonce}}) {
$self->set_error("nonce-count doesn't match: $count");
@@ -756,7 +766,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/EXTERNAL.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/EXTERNAL.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/EXTERNAL.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/EXTERNAL.pm 2026-09-06
18:43:50.000000000 +0200
@@ -3,7 +3,7 @@
# is free software; you can redistribute it and/or modify it under the
# same terms as Perl itself.
-package Authen::SASL::Perl::EXTERNAL 2.2000;
+package Authen::SASL::Perl::EXTERNAL 2.2100;
use strict;
use warnings;
@@ -45,7 +45,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/GSSAPI.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/GSSAPI.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/GSSAPI.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/GSSAPI.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# All rights reserved. This program is free software; you can redistribute
# it and/or modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::GSSAPI 2.2000;
+package Authen::SASL::Perl::GSSAPI 2.2100;
use strict;
use warnings;
@@ -228,7 +228,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/LOGIN.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/LOGIN.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/LOGIN.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/LOGIN.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::LOGIN 2.2000;
+package Authen::SASL::Perl::LOGIN 2.2100;
use strict;
use warnings;
@@ -137,7 +137,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore'
old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/OAUTHBEARER.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/OAUTHBEARER.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/OAUTHBEARER.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/OAUTHBEARER.pm 2026-09-06
18:43:50.000000000 +0200
@@ -4,7 +4,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::OAUTHBEARER 2.2000;
+package Authen::SASL::Perl::OAUTHBEARER 2.2100;
use strict;
use warnings;
@@ -81,7 +81,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/PLAIN.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/PLAIN.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/PLAIN.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/PLAIN.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::PLAIN 2.2000;
+package Authen::SASL::Perl::PLAIN 2.2100;
use strict;
use warnings;
@@ -104,7 +104,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/XOAUTH2.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/XOAUTH2.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl/XOAUTH2.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl/XOAUTH2.pm 2026-09-06
18:43:50.000000000 +0200
@@ -4,7 +4,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl::XOAUTH2 2.2000;
+package Authen::SASL::Perl::XOAUTH2 2.2100;
use strict;
use warnings;
@@ -58,7 +58,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl.pm
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl.pm 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl.pm 2026-09-06
18:43:50.000000000 +0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL::Perl 2.2000;
+package Authen::SASL::Perl 2.2100;
use strict;
use warnings;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL/Perl.pod
new/Authen-SASL-2.2100/lib/Authen/SASL/Perl.pod
--- old/Authen-SASL-2.2000/lib/Authen/SASL/Perl.pod 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL/Perl.pod 2026-09-06
18:43:50.000000000 +0200
@@ -10,7 +10,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL.pm
new/Authen-SASL-2.2100/lib/Authen/SASL.pm
--- old/Authen-SASL-2.2000/lib/Authen/SASL.pm 2026-01-28 23:00:00.000000000
+0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL.pm 2026-09-06 18:43:50.000000000
+0200
@@ -2,7 +2,7 @@
# This program is free software; you can redistribute it and/or
# modify it under the same terms as Perl itself.
-package Authen::SASL 2.2000;
+package Authen::SASL 2.2100;
use strict;
use warnings;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/lib/Authen/SASL.pod
new/Authen-SASL-2.2100/lib/Authen/SASL.pod
--- old/Authen-SASL-2.2000/lib/Authen/SASL.pod 2026-01-28 23:00:00.000000000
+0100
+++ new/Authen-SASL-2.2100/lib/Authen/SASL.pod 2026-09-06 18:43:50.000000000
+0200
@@ -4,7 +4,7 @@
=head1 VERSION
-version 2.2000
+version 2.2100
=head1 SYNOPSIS
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Authen-SASL-2.2000/t/server/digest_md5.t
new/Authen-SASL-2.2100/t/server/digest_md5.t
--- old/Authen-SASL-2.2000/t/server/digest_md5.t 2026-01-28
23:00:00.000000000 +0100
+++ new/Authen-SASL-2.2100/t/server/digest_md5.t 2026-09-06
18:43:50.000000000 +0200
@@ -8,7 +8,7 @@
eval { require Digest::HMAC_MD5 } or Test::More->import(skip_all => 'Need
Digest::HMAC_MD5');
}
-use Test::More (tests => 33);
+use Test::More (tests => 38);
use Authen::SASL qw(Perl);
use_ok 'Authen::SASL::Perl::DIGEST_MD5';
@@ -233,3 +233,36 @@
like $server->error, qr/nonce-count.*match/i, $server->error;
}
}
+
+## a response captured from another session (replayed nonce)
+{
+ ## valid for the nonce md5_hex("foobaz") issued above
+ my $captured = join ",", qw(
+ charset=utf-8
+ cnonce="3858f62230ac3c915f300c664312c63f"
+ digest-uri="ldap/elwood.innosoft.com"
+ nc=00000001
+ nonce="80338e79d2ca9b9c090ebaaa2ef293c7"
+ qop=auth
+ realm="elwood.innosoft.com"
+ response=39ab7388b1f52492b1b87cda55177d04
+ username="gbarr"
+ );
+
+ ## control: this server issues that nonce, so it must be accepted
+ $server = $sasl->server_new("ldap","elwood.innosoft.com");
+ $server->server_start('');
+ $server->server_step($captured);
+ ok $server->is_success, "response for the nonce we issued";
+ ok !$server->error, "no error" or diag $server->error;
+
+ ## the same response against a server that issued a different nonce
+ local $Authen::SASL::Perl::DIGEST_MD5::NONCE = "barquux";
+ $server = $sasl->server_new("ldap","elwood.innosoft.com");
+ my $ss;
+ $server->server_start('', sub { $ss = shift });
+ like $ss, qr/nonce="0e3bc3eed574191aefba34601d78f5c7"/, "a different nonce
was issued";
+ $server->server_step($captured);
+ ok !$server->is_success, "replayed response rejected";
+ like $server->error, qr/nonce does not match/i, $server->error;
+}
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.ilv4Kp/_old 2026-09-09 16:21:15.537295376 +0200
+++ /var/tmp/diff_new_pack.ilv4Kp/_new 2026-09-09 16:21:15.545295709 +0200
@@ -1,6 +1,6 @@
-mtime: 1769666469
-commit: d168cafaead8dd496f94f9d9340d2f3c2f8430bf4a688f2feebe7f2a8f4e6e76
-url: https://src.opensuse.org/perl/perl-Authen-SASL.git
-revision: d168cafaead8dd496f94f9d9340d2f3c2f8430bf4a688f2feebe7f2a8f4e6e76
+mtime: 1788776363
+commit: 6e8f6fa2340c4e1e459110ca97faa1cd6df7540587136028483261adc4acb854
+url: https://src.opensuse.org/perl/perl-Authen-SASL
+revision: 6e8f6fa2340c4e1e459110ca97faa1cd6df7540587136028483261adc4acb854
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-09-07 12:19:23.000000000 +0200
@@ -0,0 +1 @@
+.osc
