Source: libnet-whois-raw-perl Version: 2.99043-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for libnet-whois-raw-perl. CVE-2026-19954[0]: | Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois | command-line tool that queries WHOIS for the wrong domain for | unicode domain names. pwhois encodes each non-ASCII label directly | using Net::IDN::Punycode and prepends xn--. Apart from lowercasing | ASCII and Cyrillic letters, it skips the IDNA mapping and | normalization steps, so a label with other uppercase letters, or not | in NFC, encodes to a different A-label than its IDNA form. For | example, a label of U+00C9 followed by "cole" encodes to "xn--cole- | pka" rather than "xn--cole-9oa". The Net::Whois::Raw library | modules are not affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19954 https://www.cve.org/CVERecord?id=CVE-2026-19954 [1] https://github.com/regru/Net-Whois-Raw/issues/34 [2] https://github.com/regru/Net-Whois-Raw/pull/35 [3] https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch Please adjust the affected versions in the BTS as needed. Regards, Salvatore
