xCAT/xcat-dep
2
0
Fork 0
mirror of https://github.com/xcat2/xcat-dep.git synced 2026-10-18 09:40:32 +00:00
Code Issues Projects Releases Wiki Activity

test(xcat-dep): check every target ships Net::DNS 1.56 or newer

Browse Source 
openeuler-24.03-ppc64le ships the openEuler GA rpm perl-Net-DNS-1.40.
That release has CVE-2026-64193 (EDNS EXTENDED-ERROR code injection) and
CVE-2026-64194 (unbounded compression-pointer chains). Net::DNS 1.56
fixes both.

The test now reads the release each target ships: the version of the
pinned publisher rpm, or else the version the spec builds. It fails
when that release is below 1.56. It fails on openeuler-24.03-ppc64le
until that target builds Net::DNS from the xcat-dep spec.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
This commit is contained in:
Daniel Hilst
2026-10-01 11:38:39 -03:00
parent c7a219843e
commit 94f00b233a
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
t/net_dns_rr_types.t
+8
View File
@@ -73,7 +73,15 @@ if (($owner->{type} // '') eq 'publisher') {
# when the built rpm does not match it. A pin below $KEY_FLOOR puts a Net::DNS without KEY back
# into the repositories a service node reads, which have no EPEL copy to outrank it. An operator
# pin (">= 0.80") accepts such a build too, so only an exact version is allowed here.
# Net::DNS 1.56 fixes CVE-2026-64193 (EDNS EXTENDED-ERROR code injection) and CVE-2026-64194
# (unbounded compression-pointer chains). A target ships either the published rpm its catalog pins
# or the release this spec builds; that release, not the pin, is what reaches the repository.
my $CVE_FLOOR = '1.56';
for my $target (@targets) {
my $ships = $shipped{$target} // $version;
ok(version->parse($ships) >= version->parse($CVE_FLOOR),
"[$target] ships Net::DNS $CVE_FLOOR or newer ($ships), with CVE-2026-64193 and CVE-2026-64194 fixed");
my $pin = $manifest{$target}{'perl-Net-DNS'};
my $exact = $pin =~ /\A\d+(?:\.\d+)+\z/ ? 1 : 0;
ok($exact, "[$target] the perl-Net-DNS pin ($pin) names one exact version");