Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package perl-CGI for openSUSE:Factory checked in at 2026-11-06 19:33:30 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/perl-CGI (Old) and /work/SRC/openSUSE:Factory/.perl-CGI.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-CGI" Fri Nov 6 19:33:30 2026 rev:38 rq:1395028 version:5.20.0 Changes: -------- --- /work/SRC/openSUSE:Factory/perl-CGI/perl-CGI.changes 2026-05-14 21:42:08.572596111 +0200 +++ /work/SRC/openSUSE:Factory/.perl-CGI.new.3759290/perl-CGI.changes 2026-11-06 19:36:20.902869327 +0100 @@ -1,0 +2,152 @@ +Wed Nov 4 13:00:33 UTC 2026 - Tina Müller <[email protected]> + +- updated to 5.20.0 (5.02) + see /usr/share/doc/packages/perl-CGI/Changes + + 5.02 2026-11-03 + [ RELEASE NOTES ] + - this is a security release fixing a large number of vulnerabilities, + several of them exploitable by any client against any script. all + users should upgrade + - to fix them some default behaviour has changed, see BREAKING CHANGES + below - most changes only affect malicious or malformed requests, but + please read them before upgrading. where a change could reasonably + affect a legitimate application an opt out or migration path is given + - the minimum *supported* perl version is now 5.10, however the dist + will still install for 5.8 (no guarantees about tests passing however) + [ SECURITY ] + - denial of service: + - CVE-2026-120631: CGI::Cookie->parse (and so CGI->cookie) used a + client supplied cookie expires value as a regex, so a Cookie header + could make it die or backtrack catastrophically + bsc#1289321 + - CVE-2026-120632: a crafted multipart/related Content-Type header + caused cubic regex backtracking (~15s of CPU for an 8KB header, no + body needed) bsc#1289352 + - CVE-2026-120650: request size, param and upload limits were missing + or unenforced: $POST_MAX defaulted to no limit, and was not enforced + at all for multipart bodies without a CONTENT_LENGTH (chunked + encoding), or for the boundary line of a multipart body without a + boundary=; PUTDATA/POSTDATA/PATCHDATA bodies were read into memory + in one go; and there was no limit on the number of params or + uploads in a request (a 40MB form body took 9s and 1.5GB of memory + to parse) - see the new $CGI::MAX_PARAMS and $CGI::MAX_UPLOADS + bsc#1289440 + - CVE-2026-120651: an infinite loop reading a short PUT/POST/PATCH + body when $DISABLE_UPLOADS was set bsc#1289441 + - CVE-2026-120645: scrolling_list used submitted values as a regex + for optgroups bsc#1289435 + - CVE-2026-120646: uploadInfo() dereferenced plain strings as symbolic + references, so died when given some, e.g. "0" bsc#1289436 + - header injection / response splitting: + - CVE-2026-120639: with autoEscape off, header() decoded HTML entities + in extra header values after checking them for newlines, so + became CRLF; and multipart_start() and + CGI::Push::do_push did no newline checks + bsc#1289428 + - CVE-2026-120644: CGI::Cookie path/domain/expires were not checked, + so ";" injected other cookie attributes + bsc#1289433 + - CVE-2026-120647: the header() -attachment filename did not escape + quotes bsc#1289437 + - open redirects, and URLs/forms pointing at other hosts: + - CVE-2026-120633: url(), self_url(), virtual_host(), virtual_port() + trusted the client supplied X-Forwarded-Host header, and an + unvalidated Host, affecting the default redirect() location, + start_html(-base=>1) and default start_form() actions + bsc#1289393 + - CVE-2026-120638: redirect() HTML decoded its URL after the + application had checked it, e.g. "//evil.example/" became + "//evil.example/" bsc#1289427 + - CVE-2026-120636: URLs built from the client supplied REQUEST_URI + could be protocol relative (//evil.example), absolute-form + (http://evil.example/) or have backslashes, and url(-relative=>1) + could return e.g. javascript:alert(1) + bsc#1289396 + - cross site scripting: + - CVE-2026-120643: url()/self_url() could contain a raw single quote + (URI->canonical decodes %27) + bsc#1289432 + - CVE-2026-120648: comment() text could end the HTML comment bsc#1289439 + - information disclosure: + - CVE-2026-120634: CGI::Carp warnings buffered for warningsToBrowser + were not reset between requests in persistent environments, so one + user's warnings could be shown to another + bsc#1289394 + - CVE-2026-120635: multipart parsing differentials (fields smuggled past + a filtering proxy or WAF that parses per the RFCs): + - the boundary was matched anywhere, not only at the start of a line + - the boundary was used without its "--" for some User-Agents + - Content-Disposition name/filename were found inside other + parameters' quoted values + - boundaries over the RFC 2046 limit corrupted and merged parts + - bsc#1289395 + - other: + - CVE-2026-120641: client supplied upload filenames could contain a + path, allowing path traversal in applications that use them to save + the file bsc#1289430 + - CVE-2026-120640: clients could set POSTDATA/PUTDATA/PATCHDATA/ + XForms:Model through the query string or a form field, + indistinguishable from the real body (e.g. a cross site HTML form + posting to a JSON endpoint) + bsc#1289429 + - CVE-2026-120642: under taint mode the upload filename, uploadInfo() + values, path_info, Accept(), and some cookie and url_param values + were untainted bsc#1289431 + - CVE-2026-120637: an unrecognised REQUEST_METHOD (e.g. OPTIONS) made + the process' own command line arguments the request params + bsc#1289397 + [ BREAKING CHANGES ] + - X-Forwarded-Host is no longer used by url()/self_url()/virtual_host() + /virtual_port(), and Host is only used if it is a valid host[:port]. + behind a reverse proxy pass the right Host / SERVER_NAME, or set + $CGI::TRUST_X_FORWARDED_HOST = 1 + - $CGI::POST_MAX now defaults to 128MB, set it to -1 for no limit + - $CGI::MAX_PARAMS (10,000) and $CGI::MAX_UPLOADS (1,000) are new + limits, set them to -1 for no limit. requests exceeding any of the + limits get a "413 Request entity too large" cgi_error + - upload filenames (param('upload'), the upload filehandle, and the + upload_hook) have any directory part and control characters removed. + the raw value is in uploadInfo($fh)->{'Content-Disposition'}, or set + $CGI::SANITIZE_UPLOAD_FILENAMES = 0 + - redirect() URLs and header() values are no longer HTML unescaped - + pass e.g. /x?a=1&b=2, not /x?a=1&b=2 + - multipart_start() header names are now capitalised like header()'s + - url(-relative=>1) prefixes a result that looks like it has a scheme + with ./, and URLs built from REQUEST_URI are reduced to a path on + this host (request_uri() still returns the literal value) + - url()/self_url() percent encode single quotes + - CGI::Cookie dies if path, expires or domain contain ";" or control + characters, or domain isn't a valid host name + - header() -attachment backslash escapes " and \ in the filename + - comment() inserts a space into any "--" in its text + - client sent params named POSTDATA, PUTDATA, PATCHDATA or XForms:Model + are ignored (an application's own initializer can still set them) + - under taint mode more request data is tainted, as listed above, so + must be untainted before use in e.g. open() or system() + - malformed multipart bodies are rejected: boundaries over 200 + characters, a body supplied boundary not starting with --, or a + boundary line over 1KB. multipart/related requires the media type to + be exactly multipart/related (its parameters may now be in any order) + - offline (command line) debugging mode is only used when there is no + REQUEST_METHOD and no CGI server, FastCGI or mod_perl + - PUTDATA/POSTDATA/PATCHDATA upload_hook callbacks are now called per + 4K chunk, as they already were for multipart uploads + - the IE 3.01 for Mac / DreamPassport multipart special case is removed + [ FIX ] + - chunked (no CONTENT_LENGTH) multipart requests without a boundary= + always failed, and the boundary line read now works under mod_perl + - read_postdata_putdata ignored SPIN_LOOP_MAX, dying on the first zero + length read + - a second CGI->new in the same request lost cgi_error, and shared the + first object's param arrays + - optgroup() ignored the documented -novals option + - import_names() wiped nested packages when clearing the namespace + - an upload whose filename was "0" lost its name + - an empty extra header() value came out as a lone " + [ META ] + - all modules are now version 5.00, including CGI::Cookie (was 4.59) + [ TESTING ] + - tests for all of the above + +------------------------------------------------------------------- Old: ---- CGI-4.72.tar.gz New: ---- CGI-5.02.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ perl-CGI.spec ++++++ --- /var/tmp/diff_new_pack.oQA596/_old 2026-11-06 19:36:21.999915215 +0100 +++ /var/tmp/diff_new_pack.oQA596/_new 2026-11-06 19:36:22.000915257 +0100 @@ -18,10 +18,10 @@ %define cpan_name CGI Name: perl-CGI -Version: 4.720.0 +Version: 5.20.0 Release: 0 -# 4.72 -> normalize -> 4.720.0 -%define cpan_version 4.72 +# 5.02 -> normalize -> 5.20.0 +%define cpan_version 5.02 License: Artistic-2.0 Summary: Handle Common Gateway Interface requests and responses URL: https://metacpan.org/release/%{cpan_name} @@ -37,14 +37,12 @@ BuildRequires: perl(Test::NoWarnings) BuildRequires: perl(Test::Warn) >= 0.300 BuildRequires: perl(URI) >= 1.760 -BuildRequires: perl(parent) >= 0.225 Requires: perl(File::Temp) >= 0.17 Requires: perl(HTML::Entities) >= 3.690 Requires: perl(URI) >= 1.760 -Requires: perl(parent) >= 0.225 Provides: perl(CGI) = %{version} Provides: perl(CGI::Carp) = %{version} -Provides: perl(CGI::Cookie) = 4.590.0 +Provides: perl(CGI::Cookie) = %{version} Provides: perl(CGI::File::Temp) = %{version} Provides: perl(CGI::HTML::Functions) Provides: perl(CGI::MultipartBuffer) ++++++ CGI-4.72.tar.gz -> CGI-5.02.tar.gz ++++++ ++++ 4037 lines of diff (skipped) ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.oQA596/_old 2026-11-06 19:36:22.175922578 +0100 +++ /var/tmp/diff_new_pack.oQA596/_new 2026-11-06 19:36:22.181922829 +0100 @@ -1,6 +1,6 @@ -mtime: 1778053503 -commit: 42c8f957cf23fc35047a85dda31951120ce3842c50a6dacafad6be1521a0e9da +mtime: 1793814764 +commit: 3ed17adcd167003e0f0384e41df9f4cde9c8a2ce6d9e7141b82ff241324b5acc url: https://src.opensuse.org/perl/perl-CGI -revision: 42c8f957cf23fc35047a85dda31951120ce3842c50a6dacafad6be1521a0e9da +revision: 3ed17adcd167003e0f0384e41df9f4cde9c8a2ce6d9e7141b82ff241324b5acc projectscmsync: https://src.opensuse.org/perl/_ObsPrj ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-11-04 18:52:44.000000000 +0100 @@ -0,0 +1 @@ +.osc
