Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected], [email protected], [email protected], [email protected], [email protected] Control: affects -1 + src:libyaml-perl User: [email protected] Usertags: pu
Hi SRM, This is too late for 13.7, but can you please consider it for 13.8. libyaml-perl is affected by CVE-2026-63676 already fixed in unstable, which we marked as no-dsa for trixie. QA testing on debusine was sucessful: https://debusine.debian.net/debian/developers/work-request/1230385/ Regards, Salvatore
diff -Nru libyaml-perl-1.31/debian/changelog libyaml-perl-1.31/debian/changelog --- libyaml-perl-1.31/debian/changelog 2024-01-01 02:43:19.000000000 +0000 +++ libyaml-perl-1.31/debian/changelog 2026-09-05 09:44:37.000000000 +0000 @@ -1,3 +1,10 @@ +libyaml-perl (1.31-1+deb13u1) trixie; urgency=medium + + * Team upload. + * fix: Avoid backtracking leading to exponential load time (CVE-2026-63676) + + -- Salvatore Bonaccorso <[email protected]> Sat, 05 Sep 2026 11:44:37 +0200 + libyaml-perl (1.31-1) unstable; urgency=medium * Import upstream version 1.31. diff -Nru libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch --- libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch 1970-01-01 00:00:00.000000000 +0000 +++ libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch 2026-09-05 09:44:37.000000000 +0000 @@ -0,0 +1,27 @@ +From: =?UTF-8?q?Tina=20M=C3=BCller?= <[email protected]> +Date: Sun, 19 Jul 2026 00:12:26 +0200 +Subject: fix: Avoid backtracking leading to exponential load time +Origin: https://github.com/ingydotnet/yaml-pm/commit/9388c6a02a66db79f9d2b3727b5588272f612cf1 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-63676 + +Thanks CPANSec! +--- + lib/YAML/Loader.pm | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/YAML/Loader.pm b/lib/YAML/Loader.pm +index b3c9122f2df5..4f73deb65a9b 100644 +--- a/lib/YAML/Loader.pm ++++ b/lib/YAML/Loader.pm +@@ -615,7 +615,7 @@ sub _parse_implicit { + # remove trailing comments and whitespace + $value =~ s/^#.*$//; + $value =~ s/\s+#.*$//; +- $value =~ s/\s*$//; ++ $value =~ s/\s+$//; + return $value if $value eq ''; + return undef if $value =~ /^~$/; + return $value +-- +2.55.0 + diff -Nru libyaml-perl-1.31/debian/patches/series libyaml-perl-1.31/debian/patches/series --- libyaml-perl-1.31/debian/patches/series 2024-01-01 02:43:19.000000000 +0000 +++ libyaml-perl-1.31/debian/patches/series 2026-09-05 09:44:37.000000000 +0000 @@ -1 +1,2 @@ ysh-location.patch +fix-Avoid-backtracking-leading-to-exponential-load-t.patch
