https://bugzilla.redhat.com/show_bug.cgi?id=2030311
Bug ID: 2030311
Summary: Please branch and build perl-Authen-Krb5 in epel9
Product: Fedora EPEL
Version: epel9
Status: NEW
Component: perl-Authen-Krb5
Assignee: simon(a)sxw.org.uk
Reporter: alex.iribarren(a)cern.ch
QA Contact: extras-qa(a)fedoraproject.org
CC: perl-devel(a)lists.fedoraproject.org, simon(a)sxw.org.uk
Target Milestone: ---
Classification: Fedora
Description of problem:
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1.
2.
3.
Actual results:
Expected results:
Additional info:
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2030311
https://bugzilla.redhat.com/show_bug.cgi?id=2391834
Bug ID: 2391834
Summary: CVE-2025-40927 perl-CGI-Simple: CGI::Simple versions
1.281 and earlier for Perl has a HTTP response
splitting flaw [fedora-42]
Product: Fedora
Version: 42
Status: NEW
Whiteboard: {"flaws": ["933fd1f2-29f2-4e6e-b879-37c457b28ad7"]}
Component: perl-CGI-Simple
Keywords: Security, SecurityTracking
Assignee: spotrh(a)gmail.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: perl-devel(a)lists.fedoraproject.org, spotrh(a)gmail.com
Blocks: 2391680
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2391834
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2355705
Bug ID: 2355705
Summary: CVE-2024-13939 perl-String-Compare-ConstantTime:
String::Compare::ConstantTime for Perl through 0.321
is vulnerable to timing attacks that allow an attacker
to guess the length of a secret string [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["da725ec8-9b41-4a44-8936-c21c330ab0cf"]}
Component: perl-String-Compare-ConstantTime
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: ppisar(a)redhat.com
Reporter: ahanwate(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: jplesnik(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com
Blocks: 2355663
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2355663
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2355705
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2369462
Bug ID: 2369462
Summary: CVE-2025-40909 perl: Perl threads have a working
directory race condition where file operations may
target unintended paths [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["8b3c517f-748c-46a7-a86f-5a69dd326cf3"]}
Component: perl
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: jplesnik(a)redhat.com
Reporter: mfindra(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: iarnell(a)gmail.com, jplesnik(a)redhat.com, kasal(a)ucw.cz,
mmaslano(a)redhat.com, mspacek(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com,
psabata(a)redhat.com, rhughes(a)redhat.com,
spotrh(a)gmail.com
Blocks: 2369407 (CVE-2025-40909)
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2369407
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2369407
[Bug 2369407] CVE-2025-40909 perl: Perl threads have a working directory race
condition where file operations may target unintended paths
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2369462
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=1716324
Bug ID: 1716324
Summary: perl-Text-Xslate-3.5.6-5.fc30 is not linked to
libperl.so
Product: Fedora
Version: 30
Status: NEW
Component: perl-Text-Xslate
Assignee: jplesnik(a)redhat.com
Reporter: ppisar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: i(a)cicku.me, jplesnik(a)redhat.com,
perl-devel(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
perl-Text-Xslate-3.5.6-5.fc30 lost a dependency on libperl.so since
-Wl,--as-needed was added to distribution-wide linker flags:
$ scanelf -n blib/arch/auto/Text/Xslate/Xslate.so
TYPE NEEDED FILE
ET_DYN libc.so.6 blib/arch/auto/Text/Xslate/Xslate.so
$ ldd -r blib/arch/auto/Text/Xslate/Xslate.so
linux-vdso.so.1 (0x00007fff0d5cb000)
libc.so.6 => /lib64/libc.so.6 (0x00007f948b9a1000)
/lib64/ld-linux-x86-64.so.2 (0x00007f948bb8f000)
undefined symbol: Perl_sv_cmp (blib/arch/auto/Text/Xslate/Xslate.so)
undefined symbol: PL_ppaddr (blib/arch/auto/Text/Xslate/Xslate.so)
[...]
Xslate.so is built like this:
gcc -lpthread -shared -Wl,-z,relro -Wl,--as-needed -Wl,-z,now
-specs=/usr/lib/rpm/redhat/redhat-hardened-ld -L/usr/local/lib
-fstack-protector-strong -lperl -o blib/arch/auto/Text/Xslate/Xslate.so
lib/Text/Xslate.o src/xslate_methods.o
The cause is that -Wl,--as-needed takes effect when library is supplied and
considering only preceding object files and ignoring and following object
files. A correct linker command must list all object files before -l flags.
Like this:
gcc lib/Text/Xslate.o src/xslate_methods.o -lpthread -shared -Wl,-z,relro
-Wl,--as-needed -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld
-L/usr/local/lib -fstack-protector-strong -lperl -o
blib/arch/auto/Text/Xslate/Xslate.so
Either there is bug in perl-Text-Xslate build script or in
Module::Build::XSUtil that it uses.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2391833
Bug ID: 2391833
Summary: CVE-2025-40927 perl-CGI-Simple: CGI::Simple versions
1.281 and earlier for Perl has a HTTP response
splitting flaw [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["933fd1f2-29f2-4e6e-b879-37c457b28ad7"]}
Component: perl-CGI-Simple
Keywords: Security, SecurityTracking
Assignee: spotrh(a)gmail.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: perl-devel(a)lists.fedoraproject.org, spotrh(a)gmail.com
Blocks: 2391680
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2391833
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2387729
Bug ID: 2387729
Summary: CVE-2025-40920
perl-Catalyst-Authentication-Credential-HTTP:
Catalyst::Authentication::Credential::HTTP insecure
nonce generation [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["325962f0-3194-4188-939d-eb25add581fd"]}
Component: perl-Catalyst-Authentication-Credential-HTTP
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: emmanuel(a)seyman.fr
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: emmanuel(a)seyman.fr, iarnell(a)gmail.com,
perl-devel(a)lists.fedoraproject.org
Blocks: 2387724
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2387729
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2381743
Bug ID: 2381743
Summary: CVE-2025-40924 perl-Catalyst-Plugin-Session:
Catalyst::Plugin::Session generates session ids
insecurely [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["ec85faa5-4df6-4672-b35f-0cc4c3fcc47d"]}
Component: perl-Catalyst-Plugin-Session
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: emmanuel(a)seyman.fr
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: emmanuel(a)seyman.fr, perl-devel(a)lists.fedoraproject.org
Blocks: 2381699
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2381743
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2381430
Bug ID: 2381430
Summary: CVE-2025-40918 perl-Authen-SASL:
Authen::SASL::Perl::DIGEST_MD5 insecure cnonce
generation [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["b8a1661d-36c5-46b6-9770-4c1464735756"]}
Component: perl-Authen-SASL
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: jplesnik(a)redhat.com
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: anon.amish(a)gmail.com, jplesnik(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, steve(a)silug.org
Blocks: 2380942
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability
management information. If something is wrong or missing, please contact a
member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essent…
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2381430
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…
https://bugzilla.redhat.com/show_bug.cgi?id=2370477
Bug ID: 2370477
Summary: CVE-2011-10007 perl-File-Find-Rule-Perl:
File::Find::Rule Arbitrary Code Execution [fedora-41]
Product: Fedora
Version: 41
Status: NEW
Whiteboard: {"flaws": ["ccdc166f-e010-4850-b637-d5c4a8627e2c"]}
Component: perl-File-Find-Rule-Perl
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: rc040203(a)freenet.de
Reporter: jmoroney(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: paul(a)city-fan.org, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Blocks: 2370424
Target Milestone: ---
Classification: Fedora
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2370424
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2370477
Report this comment as SPAM: https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-sp…