https://bugzilla.redhat.com/show_bug.cgi?id=2030311
Bug ID: 2030311
Summary: Please branch and build perl-Authen-Krb5 in epel9
Product: Fedora EPEL
Version: epel9
Status: NEW
Component: perl-Authen-Krb5
Assignee: simon(a)sxw.org.uk
Reporter: alex.iribarren(a)cern.ch
QA Contact: extras-qa(a)fedoraproject.org
CC: perl-devel(a)lists.fedoraproject.org, simon(a)sxw.org.uk
Target Milestone: ---
Classification: Fedora
Description of problem:
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030311
https://bugzilla.redhat.com/show_bug.cgi?id=2355705
Bug ID: 2355705
Summary: CVE-2024-13939 perl-String-Compare-ConstantTime:
String::Compare::ConstantTime for Perl through 0.321
is vulnerable to timing attacks that allow an attacker
to guess the length of a secret string [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["da725ec8-9b41-4a44-8936-c21c330ab0cf"]}
Component: perl-String-Compare-ConstantTime
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ppisar(a)redhat.com
Reporter: ahanwate(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jplesnik(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com
Blocks: 2355663
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2355663
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2355705
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2369462
Bug ID: 2369462
Summary: CVE-2025-40909 perl: Perl threads have a working
directory race condition where file operations may
target unintended paths [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["8b3c517f-748c-46a7-a86f-5a69dd326cf3"]}
Component: perl
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: jplesnik(a)redhat.com
Reporter: mfindra(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: iarnell(a)gmail.com, jplesnik(a)redhat.com, kasal(a)ucw.cz,
mmaslano(a)redhat.com, mspacek(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com,
psabata(a)redhat.com, rhughes(a)redhat.com,
spotrh(a)gmail.com
Blocks: 2369407 (CVE-2025-40909)
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2369407
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2369407
[Bug 2369407] CVE-2025-40909 perl: Perl threads have a working directory race
condition where file operations may target unintended paths
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2369462
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=1716324
Bug ID: 1716324
Summary: perl-Text-Xslate-3.5.6-5.fc30 is not linked to
libperl.so
Product: Fedora
Version: 30
Status: NEW
Component: perl-Text-Xslate
Assignee: jplesnik(a)redhat.com
Reporter: ppisar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: i(a)cicku.me, jplesnik(a)redhat.com,
perl-devel(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
perl-Text-Xslate-3.5.6-5.fc30 lost a dependency on libperl.so since
-Wl,--as-needed was added to distribution-wide linker flags:
$ scanelf -n blib/arch/auto/Text/Xslate/Xslate.so
TYPE NEEDED FILE
ET_DYN libc.so.6 blib/arch/auto/Text/Xslate/Xslate.so
$ ldd -r blib/arch/auto/Text/Xslate/Xslate.so
linux-vdso.so.1 (0x00007fff0d5cb000)
libc.so.6 => /lib64/libc.so.6 (0x00007f948b9a1000)
/lib64/ld-linux-x86-64.so.2 (0x00007f948bb8f000)
undefined symbol: Perl_sv_cmp (blib/arch/auto/Text/Xslate/Xslate.so)
undefined symbol: PL_ppaddr (blib/arch/auto/Text/Xslate/Xslate.so)
[...]
Xslate.so is built like this:
gcc -lpthread -shared -Wl,-z,relro -Wl,--as-needed -Wl,-z,now
-specs=/usr/lib/rpm/redhat/redhat-hardened-ld -L/usr/local/lib
-fstack-protector-strong -lperl -o blib/arch/auto/Text/Xslate/Xslate.so
lib/Text/Xslate.o src/xslate_methods.o
The cause is that -Wl,--as-needed takes effect when library is supplied and
considering only preceding object files and ignoring and following object
files. A correct linker command must list all object files before -l flags.
Like this:
gcc lib/Text/Xslate.o src/xslate_methods.o -lpthread -shared -Wl,-z,relro
-Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
-L/usr/local/lib -fstack-protector-strong -lperl -o
blib/arch/auto/Text/Xslate/Xslate.so
Either there is bug in perl-Text-Xslate build script or in
Module::Build::XSUtil that it uses.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2369086
Bug ID: 2369086
Summary: CVE-2025-31501 rt: From CVEorg collector [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["c8ec98c3-462b-423d-8c73-182e3e8d58e8"]}
Component: rt
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: rc040203(a)freenet.de
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: j(a)tib.bs, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Blocks: 2369046
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2369046
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2369086
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2369083
Bug ID: 2369083
Summary: CVE-2025-31500 rt: From CVEorg collector [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["c55fe921-0a1e-4abb-a764-5cffc06fc38e"]}
Component: rt
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: rc040203(a)freenet.de
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: j(a)tib.bs, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Blocks: 2369035
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2369035
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2369083
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2369082
Bug ID: 2369082
Summary: CVE-2025-30087 rt: From CVEorg collector [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["8e43c34c-92f9-4837-b611-089f87706095"]}
Component: rt
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: rc040203(a)freenet.de
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: j(a)tib.bs, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Blocks: 2369036
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2369036
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2369082
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2364067
Bug ID: 2364067
Summary: CVE-2024-58135 perl-Mojolicious: Mojolicious versions
from 7.28 through 9.39 for Perl may generate weak HMAC
session secrets [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["a53a0372-1a9f-412e-9645-c9a8bb2afc69"]}
Component: perl-Mojolicious
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: emmanuel(a)seyman.fr
Reporter: kdudka(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: emmanuel(a)seyman.fr,
perl-devel(a)lists.fedoraproject.org,
robinlee.sysu(a)gmail.com, yaneti(a)declera.com
Blocks: 2363873
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2363873
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2364067
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2364058
Bug ID: 2364058
Summary: CVE-2024-58134 perl-Mojolicious: Mojolicious versions
from 0.999922 through 9.39 for Perl uses a hard coded
string, or the application's class name, as a HMAC
session secret by default [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["77dfeebf-9683-4991-96a9-f90ef383361c"]}
Component: perl-Mojolicious
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: emmanuel(a)seyman.fr
Reporter: kdudka(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: emmanuel(a)seyman.fr,
perl-devel(a)lists.fedoraproject.org,
robinlee.sysu(a)gmail.com, yaneti(a)declera.com
Blocks: 2363893
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2363893
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2364058
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2338799
Bug ID: 2338799
Summary: Many core Perl modules are missing
Product: Fedora
Version: 41
Hardware: x86_64
OS: Linux
Status: NEW
Component: perl
Severity: medium
Assignee: jplesnik(a)redhat.com
Reporter: davidlevner(a)yahoo.com
QA Contact: extras-qa(a)fedoraproject.org
CC: iarnell(a)gmail.com, jplesnik(a)redhat.com, kasal(a)ucw.cz,
mmaslano(a)redhat.com, mspacek(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com,
psabata(a)redhat.com, rhughes(a)redhat.com,
spotrh(a)gmail.com
Target Milestone: ---
Classification: Fedora
Created attachment 2066675
--> https://bugzilla.redhat.com/attachment.cgi?id=2066675&action=edit
List of core Perl modules missing after installing Fedora 41
Description of problem:
When I did a fresh install of Fedora 41 on a new computer, many core Perl
modules and programs were not installed. I have a fairly complete list of
modules that I generated with a Perl script (see attachment). I don't have a
complete list of Perl core programs, but I do know that perl5db.pl is missing.
You can't run the Perl debugger without perl5db.pl.
Version-Release number of selected component (if applicable):
Perl v 5.40.0
How reproducible:
I only did a fresh install of Fedora 41 once. The problem occurred. I don't
have the resources to reproduce the problem on other computers.
Steps to Reproduce:
1. Create a fresh installation of Fedora 41.
2. Search the following directories for the modules listed in the attachment:
/usr/local/lib64/perl5/5.40
/usr/local/share/perl5/5.40
/usr/lib64/perl5/vendor_perl
/usr/share/perl5/vendor_perl
/usr/lib64/perl5
/usr/share/perl5
For perl5db.pl, type "which perl5db.pl" or look in all the directories in your
execution path for a file of this name.
Actual results:
perl5db.pl and the modules are not found.
Expected results:
perl5db.pl and all the modules are found.
Additional info:
For a discussion of what constitutes a core Perl module, see
https://www.perl.com/article/what-is-the-perl-core-/. This article confirms
that Fedora has a long-standing problem of omitting core Perl modules.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2338799
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…