Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-Mail-Sendmail for
openSUSE:Factory checked in at 2026-11-07 23:33:26
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-Mail-Sendmail (Old)
and /work/SRC/openSUSE:Factory/.perl-Mail-Sendmail.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-Mail-Sendmail"
Sat Nov 7 23:33:26 2026 rev:23 rq:1396032 version:0.830.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-Mail-Sendmail/perl-Mail-Sendmail.changes
2025-07-22 12:20:16.540073382 +0200
+++
/work/SRC/openSUSE:Factory/.perl-Mail-Sendmail.new.3759290/perl-Mail-Sendmail.changes
2026-11-07 23:34:11.593464599 +0100
@@ -1,0 +2,14 @@
+Sun Jul 5 08:16:06 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 0.830.0 (0.83)
+ see /usr/share/doc/packages/perl-Mail-Sendmail/Changes
+
+ 0.83 2026-07-04 NEILB
+ - strip CR/LF from header values, to prevent insertion of rogue headers.
+ Deals with issue in CVE-2026-13092. Pull request from Olaf Alders++.
+ - Tried using [PkgVersion] so $VERSION would be auto managed, but
+ caused issues testing as the code expects $VERSION to be there
pre-build.
+ - switched to a new test Sendmail server for t/original.t, as the old
+ one was no longer accepting connections.
+
+-------------------------------------------------------------------
Old:
----
Mail-Sendmail-0.82.tar.gz
New:
----
Mail-Sendmail-0.83.tar.gz
README.md
_scmsync.obsinfo
build.specials.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-Mail-Sendmail.spec ++++++
--- /var/tmp/diff_new_pack.6EA0uE/_old 2026-11-07 23:34:13.674550587 +0100
+++ /var/tmp/diff_new_pack.6EA0uE/_new 2026-11-07 23:34:13.678550753 +0100
@@ -1,7 +1,7 @@
#
# spec file for package perl-Mail-Sendmail
#
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC and contributors
#
# All modifications and additions to the file contributed by third parties
# remain the property of their copyright owners, unless otherwise agreed
@@ -18,23 +18,25 @@
%define cpan_name Mail-Sendmail
Name: perl-Mail-Sendmail
-Version: 0.820.0
+Version: 0.830.0
Release: 0
-# 0.82 -> normalize -> 0.820.0
-%define cpan_version 0.82
+# 0.83 -> normalize -> 0.830.0
+%define cpan_version 0.83
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: Simple platform independent mailer
URL: https://metacpan.org/release/%{cpan_name}
Source0:
https://cpan.metacpan.org/authors/id/N/NE/NEILB/%{cpan_name}-%{cpan_version}.tar.gz
Source1: cpanspec.yml
+Source100: README.md
BuildArch: noarch
BuildRequires: perl
BuildRequires: perl-macros
BuildRequires: perl(Sys::Hostname::Long)
+BuildRequires: perl(Test::TCP)
BuildRequires: perl(parent)
Requires: perl(Sys::Hostname::Long)
Requires: perl(parent)
-Provides: perl(Mail::Sendmail) = 0.800.0
+Provides: perl(Mail::Sendmail) = %{version}
%undefine __perllib_provides
%{perl_requires}
# MANUAL BEGIN
++++++ Mail-Sendmail-0.82.tar.gz -> Mail-Sendmail-0.83.tar.gz ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/Changes
new/Mail-Sendmail-0.83/Changes
--- old/Mail-Sendmail-0.82/Changes 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/Changes 2026-07-04 11:10:21.000000000 +0200
@@ -1,5 +1,13 @@
Revision history for Perl module Mail::Sendmail
+0.83 2026-07-04 NEILB
+ - strip CR/LF from header values, to prevent insertion of rogue headers.
+ Deals with issue in CVE-2026-13092. Pull request from Olaf Alders++.
+ - Tried using [PkgVersion] so $VERSION would be auto managed, but
+ caused issues testing as the code expects $VERSION to be there pre-build.
+ - switched to a new test Sendmail server for t/original.t, as the old
+ one was no longer accepting connections.
+
0.82 2025-07-14 NEILB
- Improvement from Pete Houston to use Sys::Hostname::Long
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/MANIFEST
new/Mail-Sendmail-0.83/MANIFEST
--- old/Mail-Sendmail-0.82/MANIFEST 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/MANIFEST 2026-07-04 11:10:21.000000000 +0200
@@ -1,4 +1,4 @@
-# This file was automatically generated by Dist::Zilla::Plugin::Manifest
v6.032.
+# This file was automatically generated by Dist::Zilla::Plugin::Manifest v6.037
Changes
LICENSE
MANIFEST
@@ -9,4 +9,6 @@
Todo
dist.ini
lib/Mail/Sendmail.pm
+t/crlf_injection.t
+t/lib/FakeSMTP.pm
t/original.t
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/META.json
new/Mail-Sendmail-0.83/META.json
--- old/Mail-Sendmail-0.82/META.json 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/META.json 2026-07-04 11:10:21.000000000 +0200
@@ -4,7 +4,7 @@
"Milivoj Ivkovic <[email protected]>"
],
"dynamic_config" : 0,
- "generated_by" : "Dist::Zilla version 6.032, CPAN::Meta::Converter version
2.150010",
+ "generated_by" : "Dist::Zilla version 6.037, CPAN::Meta::Converter version
2.150010",
"license" : [
"perl_5"
],
@@ -34,6 +34,15 @@
"vars" : "0",
"warnings" : "0"
}
+ },
+ "test" : {
+ "requires" : {
+ "File::Temp" : "0",
+ "IO::Socket::INET" : "0",
+ "Test::More" : "0",
+ "Test::TCP" : "0",
+ "lib" : "0"
+ }
}
},
"release_status" : "stable",
@@ -45,7 +54,7 @@
"web" : "https://github.com/neilb/Mail-Sendmail";
}
},
- "version" : "0.82",
+ "version" : "0.83",
"x_generated_by_perl" : "v5.32.1",
"x_serialization_backend" : "Cpanel::JSON::XS version 4.38",
"x_spdx_expression" : "Artistic-1.0-Perl OR GPL-1.0-or-later"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/META.yml
new/Mail-Sendmail-0.83/META.yml
--- old/Mail-Sendmail-0.82/META.yml 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/META.yml 2026-07-04 11:10:21.000000000 +0200
@@ -2,11 +2,16 @@
abstract: 'Simple platform independent mailer'
author:
- 'Milivoj Ivkovic <[email protected]>'
-build_requires: {}
+build_requires:
+ File::Temp: '0'
+ IO::Socket::INET: '0'
+ Test::More: '0'
+ Test::TCP: '0'
+ lib: '0'
configure_requires:
ExtUtils::MakeMaker: '0'
dynamic_config: 0
-generated_by: 'Dist::Zilla version 6.032, CPAN::Meta::Converter version
2.150010'
+generated_by: 'Dist::Zilla version 6.037, CPAN::Meta::Converter version
2.150010'
license: perl
meta-spec:
url: http://module-build.sourceforge.net/META-spec-v1.4.html
@@ -28,7 +33,7 @@
resources:
homepage: https://github.com/neilb/Mail-Sendmail
repository: https://github.com/neilb/Mail-Sendmail.git
-version: '0.82'
+version: '0.83'
x_generated_by_perl: v5.32.1
x_serialization_backend: 'YAML::Tiny version 1.73'
x_spdx_expression: 'Artistic-1.0-Perl OR GPL-1.0-or-later'
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/Makefile.PL
new/Mail-Sendmail-0.83/Makefile.PL
--- old/Mail-Sendmail-0.82/Makefile.PL 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/Makefile.PL 2026-07-04 11:10:21.000000000 +0200
@@ -1,4 +1,4 @@
-# This file was automatically generated by Dist::Zilla::Plugin::MakeMaker
v6.032.
+# This file was automatically generated by Dist::Zilla::Plugin::MakeMaker
v6.037
use strict;
use warnings;
@@ -29,7 +29,14 @@
"vars" => 0,
"warnings" => 0
},
- "VERSION" => "0.82",
+ "TEST_REQUIRES" => {
+ "File::Temp" => 0,
+ "IO::Socket::INET" => 0,
+ "Test::More" => 0,
+ "Test::TCP" => 0,
+ "lib" => 0
+ },
+ "VERSION" => "0.83",
"test" => {
"TESTS" => "t/*.t"
}
@@ -39,11 +46,16 @@
my %FallbackPrereqs = (
"Digest::MD5" => 0,
"Exporter" => 0,
+ "File::Temp" => 0,
+ "IO::Socket::INET" => 0,
"MIME::Base64" => 0,
"Socket" => 0,
"Sys::Hostname" => 0,
"Sys::Hostname::Long" => 0,
+ "Test::More" => 0,
+ "Test::TCP" => 0,
"Time::Local" => 0,
+ "lib" => 0,
"parent" => 0,
"strict" => 0,
"vars" => 0,
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/dist.ini
new/Mail-Sendmail-0.83/dist.ini
--- old/Mail-Sendmail-0.82/dist.ini 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/dist.ini 2026-07-04 11:10:21.000000000 +0200
@@ -4,7 +4,7 @@
copyright_holder = Milivoj Ivkovic
copyright_year = 1998
-version = 0.82
+version = 0.83
[@Filter]
-bundle = @Basic
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/lib/Mail/Sendmail.pm
new/Mail-Sendmail-0.83/lib/Mail/Sendmail.pm
--- old/Mail-Sendmail-0.82/lib/Mail/Sendmail.pm 2025-07-14 14:41:56.000000000
+0200
+++ new/Mail-Sendmail-0.83/lib/Mail/Sendmail.pm 2026-07-04 11:10:21.000000000
+0200
@@ -10,9 +10,9 @@
=cut
-require 5.006;
+our $VERSION = "0.83";
-our $VERSION = "0.80";
+require 5.006;
use strict;
use warnings;
@@ -249,9 +249,18 @@
$k =~ s/-(.)/"-" . uc($1)/ge;
$mail{$k} = shift @_;
if ($k !~ /^(Message|Body|Text)$/i) {
- # normalize possible line endings in headers
- $mail{$k} =~ s/\015\012?/\012/go;
- $mail{$k} =~ s/\012/$CRLF/go;
+ # Strip any CR/LF characters from header values to prevent
+ # CRLF injection (SMTP header injection). Attacker-controlled
+ # header values containing "\nBcc: [email protected]" would
+ # otherwise inject new headers or body content.
+ # See CWE-93 (Improper Neutralization of CRLF Sequences) and
+ # the equivalent fixes in Email::MIME (CVE-2024-4140) and
+ # many other mail libraries.
+ if ($mail{$k} =~ /[\015\012]/) {
+ warn "Mail::Sendmail: stripping CR/LF from $k header to "
+ . "prevent CRLF injection\n";
+ $mail{$k} =~ s/[\015\012]+//g;
+ }
}
}
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/t/crlf_injection.t
new/Mail-Sendmail-0.83/t/crlf_injection.t
--- old/Mail-Sendmail-0.82/t/crlf_injection.t 1970-01-01 01:00:00.000000000
+0100
+++ new/Mail-Sendmail-0.83/t/crlf_injection.t 2026-07-04 11:10:21.000000000
+0200
@@ -0,0 +1,43 @@
+#!/usr/bin/perl -w
+
+# Offline test: header values must not be able to inject extra SMTP
+# headers via embedded CR/LF (header injection). FakeSMTP runs a local
+# throwaway SMTP server, captures the DATA section, and we inspect the
+# headers that were actually put on the wire.
+
+use strict;
+use warnings;
+
+use lib 't/lib';
+use Test::More;
+use FakeSMTP qw(capture_sent);
+
+subtest 'newline in a header value cannot inject a new header' => sub {
+ my $data = capture_sent(
+ From => '[email protected]',
+ To => '[email protected]',
+ Subject => "Hello\nBcc: attacker\@example.net",
+ Message => "body\n",
+ );
+
+ my ($headers) = split /\r?\n\r?\n/, $data, 2;
+ unlike $headers, qr/^Bcc:/im,
+ 'injected Bcc does not appear as a header line';
+};
+
+subtest 'legitimate multi-line message bodies are preserved' => sub {
+ my $data = capture_sent(
+ From => '[email protected]',
+ To => '[email protected]',
+ Subject => 'Plain subject',
+ Message => "Line one\nLine two\n",
+ );
+
+ # Assert the separator between the lines survived (as SMTP CRLF), not
+ # just that both lines appear somewhere: "Line oneLine two" must fail.
+ my (undef, $body) = split /\r\n\r\n/, $data, 2;
+ like $body, qr/\ALine one\r\nLine two\r\n/,
+ 'body lines preserved with their line breaks intact';
+};
+
+done_testing;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/t/lib/FakeSMTP.pm
new/Mail-Sendmail-0.83/t/lib/FakeSMTP.pm
--- old/Mail-Sendmail-0.82/t/lib/FakeSMTP.pm 1970-01-01 01:00:00.000000000
+0100
+++ new/Mail-Sendmail-0.83/t/lib/FakeSMTP.pm 2026-07-04 11:10:21.000000000
+0200
@@ -0,0 +1,85 @@
+package FakeSMTP;
+
+# Test helper: run Mail::Sendmail's sendmail() against a throwaway local
+# SMTP server (no real network, no real mail) and return the raw DATA
+# payload the client put on the wire, so tests can inspect exactly what
+# was transmitted.
+#
+# The server lifecycle (fork, ephemeral port, readiness wait, cleanup) is
+# handled by Test::TCP; we only supply the tiny SMTP dialog.
+
+use strict;
+use warnings;
+
+use Exporter 'import';
+use File::Temp ();
+use IO::Socket::INET ();
+use Mail::Sendmail ();
+use Test::TCP ();
+
+our @EXPORT = qw(capture_sent);
+
+# capture_sent(%mail) -> the raw DATA payload (headers + body) that
+# sendmail() transmitted for %mail.
+sub capture_sent {
+ my %mail = @_;
+
+ # The server runs in a child process; it hands the captured payload
+ # back through this temp file. Kept in scope for the whole sub so
+ # File::Temp does not unlink it before we read it.
+ my $capture = File::Temp->new;
+ my $capture_path = $capture->filename;
+
+ my $server = Test::TCP->new( code => sub { _serve(shift, $capture_path) }
);
+
+ # Don't MIME-encode the body, so the captured payload is predictable.
+ local $Mail::Sendmail::mailcfg{mime} = 0;
+ $mail{Smtp} = '127.0.0.1:' . $server->port;
+ Mail::Sendmail::sendmail(%mail);
+
+ open my $fh, '<', $capture_path or die "no captured payload: $!";
+ local $/;
+ my $data = <$fh>;
+ close $fh;
+ return $data;
+}
+
+# The fake SMTP server: accept a connection, answer just enough of the
+# dialog to reach DATA, capture the payload, then acknowledge.
+sub _serve {
+ my ($port, $capture_path) = @_;
+
+ my $listen = IO::Socket::INET->new(
+ LocalAddr => '127.0.0.1',
+ LocalPort => $port,
+ Listen => 5,
+ ReuseAddr => 1,
+ Proto => 'tcp',
+ ) or die "fake SMTP listen failed: $!";
+
+ while (my $client = $listen->accept) {
+ $client->autoflush(1);
+ print {$client} "220 fake ESMTP\r\n";
+ my $data = '';
+ while (my $line = <$client>) {
+ if ($line =~ /^DATA/i) {
+ print {$client} "354 go ahead\r\n";
+ while (my $dl = <$client>) {
+ last if $dl eq ".\r\n" or $dl eq ".\n";
+ $data .= $dl;
+ }
+ # Record the payload BEFORE the 250 that releases the
+ # client, so the parent can rely on it being complete
+ # once sendmail() returns.
+ open my $fh, '>', $capture_path or die "capture: $!";
+ print {$fh} $data;
+ close $fh;
+ print {$client} "250 queued\r\n";
+ }
+ elsif ($line =~ /^QUIT/i) { print {$client} "221 bye\r\n"; last }
+ else { print {$client} "250 ok\r\n" } #
greeting/EHLO/MAIL/RCPT
+ }
+ }
+}
+
+1;
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Mail-Sendmail-0.82/t/original.t
new/Mail-Sendmail-0.83/t/original.t
--- old/Mail-Sendmail-0.82/t/original.t 2025-07-14 14:41:56.000000000 +0200
+++ new/Mail-Sendmail-0.83/t/original.t 2026-07-04 11:10:21.000000000 +0200
@@ -14,7 +14,7 @@
# if you want to get a copy of the test mail, you need to specify your
# own server here, by name or IP address
-$server = 'mail.alma.ch';
+$server = 'smtp.freesmtpservers.com';
#$server = 'my.usual.mail.server';
BEGIN { $| = 1; print "1..2\n"; }
++++++ README.md ++++++
## Build Results
Current state of perl in openSUSE:Factory is
The current state of perl in the devel project build (devel:languages:perl)
++++++ _scmsync.obsinfo ++++++
mtime: 1783239366
commit: 19a8149815b0bf65ded100045bd992edb5738140c326d3aeb20d827517085407
url: https://src.opensuse.org/perl/perl-Mail-Sendmail
revision: 19a8149815b0bf65ded100045bd992edb5738140c326d3aeb20d827517085407
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-07-05 10:16:06.000000000 +0200
@@ -0,0 +1 @@
+.osc
