ok.
pretty low impact I think but 7.8-stable makes sense to me. we don't do
-stable ports commits for older releases.
--
Sent from a phone, apologies for poor formatting.
On 11 April 2026 17:53:25 Andrew Hewus Fresh <[email protected]> wrote:
Two CVE fixes:
- Security: (CVE-2026-40198) Reject invalid uncompressed IPv6.
https://lists.security.metacpan.org/cve-announce/msg/38785616/
Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped
IPv6 addresses, which may allow IP ACL bypass
- Security: (CVE-2026-40199) Fix IPv4 mapped IPv6 packed length.
https://lists.security.metacpan.org/cve-announce/msg/38785618/
Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6
group count, which may allow IP ACL bypass
OK? Commit to OPENBSD_7_8? OPENBSD_7_7?
Index: Makefile
===================================================================
RCS file: /cvs/ports/net/p5-Net-CIDR-Lite/Makefile,v
diff -u -p -r1.15 Makefile
--- Makefile 11 Mar 2022 19:46:39 -0000 1.15
+++ Makefile 11 Apr 2026 16:48:37 -0000
@@ -2,7 +2,8 @@ COMMENT= Perl extension for merging IPv4
MODULES= cpan
PKG_ARCH= *
-DISTNAME= Net-CIDR-Lite-0.22
+DISTNAME= Net-CIDR-Lite-0.23
+CPAN_AUTHOR= STIGTSP
CATEGORIES= net
# GPL/Artistic
Index: distinfo
===================================================================
RCS file: /cvs/ports/net/p5-Net-CIDR-Lite/distinfo,v
diff -u -p -r1.8 distinfo
--- distinfo 5 Apr 2021 13:21:48 -0000 1.8
+++ distinfo 11 Apr 2026 16:48:37 -0000
@@ -1,2 +1,2 @@
-SHA256 (Net-CIDR-Lite-0.22.tar.gz) =
QxfYyzQaYXueCIjaQ8Cc3//8sMnt97jJko10KlY7hRc=
-SIZE (Net-CIDR-Lite-0.22.tar.gz) = 10823
+SHA256 (Net-CIDR-Lite-0.23.tar.gz) =
mlgnjkmgjN65vsAc7N06lb5zbQ59TQXRP5COOj/hDTI=
+SIZE (Net-CIDR-Lite-0.23.tar.gz) = 11089
