perl-Net-DNS built Net::DNS 1.47 without patches. That release decodes
the EDNS EXTENDED-ERROR text with a string eval (CVE-2026-64193) and
follows compression pointer chains of any depth (CVE-2026-64194).
Net::DNS 1.56 fixes both, and 1.57 also stops an unbounded recursion on
a misplaced TSIG.
Build Net::DNS 1.57. The tarball, the spec, the Buildnote and the
riscv64 manifest pin move together. The build requirements of 1.57 are
the same as those of 1.47.
t/net_dns_rr_types.t decodes a reply with a 200-pointer chain and fails
on 1.47.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Net::DNS 0.80 leaves the KEY record to Net::DNS::SEC, which xcat-dep
does not build. On riscv64, makedns fails when ddns.pm builds its
update key.
perl-Net-DNS now builds 1.47, the release EPEL 10 ships, and the
riscv64 manifest pins it. The spec drops --noxs, which 1.47 rejects,
passes --noonline-tests, and excludes the false perl(OS_CONF) Requires.
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Daniel Hilst
ligc
daniceexi