diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch new file mode 100644 index 0000000000..844885d936 --- /dev/null +++ b/meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380.patch @@ -0,0 +1,37 @@ +From 509bbfcff36b1b1e1d81cc3ca435974448b9835c Mon Sep 17 00:00:00 2001 +From: Robert Rothenberg +Date: Wed, 1 Jul 2026 22:31:56 +0100 +Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380] + +CVE: CVE-2026-14380 +Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259] + +(cherry picked from commit b73d5d9901767fc1d16b6661ef08fbed4532e259) +Signed-off-by: Hetvi Thakar +--- + lib/DBI/Profile.pm | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm +index 9b16c53..66f39ec 100644 +--- a/lib/DBI/Profile.pm ++++ b/lib/DBI/Profile.pm +@@ -679,6 +679,7 @@ use warnings; + use Exporter (); + use UNIVERSAL (); + use Carp; ++use Module::Load (); + + use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge); + +@@ -758,7 +759,9 @@ sub _auto_new { + } + } + +- eval "require $package" if $package; # silently ignores errors ++ eval { ++ Module::Load::load $package if $package; # silently ignores errors ++ }; + $package ||= $class; + + return $package->new(Path => \@Path, @args); diff --git a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb index 5a76924560..a852dc276a 100644 --- a/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb +++ b/meta-oe/recipes-devtools/perl/libdbi-perl_1.647.bb @@ -12,6 +12,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=65f65488c774efe1da488e36ad6c4a36" SRC_URI = "${CPAN_MIRROR}/authors/id/H/HM/HMBRAND/DBI-${PV}.tgz \ file://CVE-2026-9698.patch \ file://CVE-2026-10879.patch \ + file://CVE-2026-14380.patch \ " SRC_URI[sha256sum] = "0df16af8e5b3225a68b7b592ab531004ddb35a9682b50300ce50174ad867d9aa" @@ -41,6 +42,7 @@ RDEPENDS:${PN}:class-target = " \ perl-module-exporter-heavy \ perl-module-dynaloader \ perl-module-io-dir \ + perl-module-load \ perl-module-scalar-util \ perl-module-universal \ "