Daniel Hilst e125f6f79f fix(xcat-dep): the riscv64 Net::DNS carries CVE-2026-64193 and CVE-2026-64194 ...

perl-Net-DNS built Net::DNS 1.47 without patches. That release decodes
the EDNS EXTENDED-ERROR text with a string eval (CVE-2026-64193) and
follows compression pointer chains of any depth (CVE-2026-64194).
Net::DNS 1.56 fixes both, and 1.57 also stops an unbounded recursion on
a misplaced TSIG.

Build Net::DNS 1.57. The tarball, the spec, the Buildnote and the
riscv64 manifest pin move together. The build requirements of 1.57 are
the same as those of 1.47.

t/net_dns_rr_types.t decodes a reply with a 200-pointer chain and fails
on 1.47.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-09-29 08:46:22 -03:00

..

Buildnote

fix(xcat-dep): the riscv64 Net::DNS carries CVE-2026-64193 and CVE-2026-64194

2026-09-29 08:46:22 -03:00

Net-DNS-1.57.tar.gz

fix(xcat-dep): the riscv64 Net::DNS carries CVE-2026-64193 and CVE-2026-64194

2026-09-29 08:46:22 -03:00

Net-DNS.spec

fix(xcat-dep): the riscv64 Net::DNS carries CVE-2026-64193 and CVE-2026-64194

2026-09-29 08:46:22 -03:00