mirrors/meta-openembedded
1
0
Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-08-25 17:32:06 +00:00
Code Issues Projects Releases Wiki Activity

libdbi-perl: Fix CVE-2026-14380

Browse Source 
Backport the ordered upstream fix and regression-test chain from DBI
1.650. Add perl-module-load to RDEPENDS to satisfy the runtime
dependency introduced by the primary fix's use of Module::Load.

[1] https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259
[2] https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8
[3] https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0
[4] https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200
[5] https://nvd.nist.gov/vuln/detail/CVE-2026-14380

Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Hetvi Thakar
2026-07-29 02:25:53 -07:00
committed by Anuj Mittal
parent 3304a04085
commit dacd50f84e
5 changed files with 190 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p1.patch
+37
View File
@@ -0,0 +1,37 @@
From b588d38661f00361bcf62b2665905ade844866ee Mon Sep 17 00:00:00 2001
From: Robert Rothenberg <perl@rhizomnic.com>
Date: Wed, 1 Jul 2026 22:31:56 +0100
Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380]
CVE: CVE-2026-14380
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259]
(cherry picked from commit b73d5d9901767fc1d16b6661ef08fbed4532e259)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
lib/DBI/Profile.pm | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm
index f2cc886..4188462 100644
--- a/lib/DBI/Profile.pm
+++ b/lib/DBI/Profile.pm
@@ -679,6 +679,7 @@ use vars qw(@ISA @EXPORT @EXPORT_OK $VERSION);
use Exporter ();
use UNIVERSAL ();
use Carp;
+use Module::Load ();
use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge);
@@ -758,7 +759,9 @@ sub _auto_new {
}
}
- eval "require $package" if $package; # silently ignores errors
+ eval {
+ Module::Load::load $package if $package; # silently ignores errors
+ };
$package ||= $class;
return $package->new(Path => \@Path, @args);
meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p2.patch
+65
View File
@@ -0,0 +1,65 @@
From 54d3e792a236385930e387b28b6c8be779b8d7f7 Mon Sep 17 00:00:00 2001
From: Robert Rothenberg <perl@rhizomnic.com>
Date: Wed, 1 Jul 2026 23:03:34 +0100
Subject: [PATCH] Add tests for CVE-2026-14380
CVE: CVE-2026-14380
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/d982411aec73b3acfc4e9e465358bca9eb7fede8]
(cherry picked from commit d982411aec73b3acfc4e9e465358bca9eb7fede8)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
t/40profile.t | 38 ++++++++++++++++++++++++++++++++++++++
1 file changed, 38 insertions(+)
diff --git a/t/40profile.t b/t/40profile.t
index 7a71b8f..5c72449 100644
--- a/t/40profile.t
+++ b/t/40profile.t
@@ -458,8 +458,46 @@ is("@$totals", "27.00 2.93 0.11 0.01 0.23 1023110000.00 1023110010.00",
'merged time foo/bar');
is($total_time, 2.93, 'merged nodes foo/bar time');
+subtest "CVE-2026-14380" => sub {
+
+ {
+ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
+ local $ENV{DBI_PROFILE} = payload_for($marker);
+ my $dbh = eval {
+ DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 })
+ };
+ ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload";
+ }
+
+ {
+ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
+ my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 });
+ eval {
+ $dbh->{Profile} = payload_for($marker);
+ };
+ ok !( -e "/tmp/$marker" ), "Set Profile payload";
+ }
+
+ {
+ my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
+ my $payload = payload_for($marker);
+ my $dsn = "dbi:Sponge(Profile=>$payload):";
+ my $dbh = eval {
+ DBI->connect($dsn, "", "", { RaiseError => 0 })
+ };
+ ok !( -e "/tmp/$marker" ), "DSN payload";
+ }
+
+};
+
exit 0;
+sub payload_for {
+ my ($marker) = @_;
+ # Single-quoted q{...} so \x2f is literal backslash-x-2-f for split;
+ # the inner qq(...) re-interprets \x2f = / at eval-time.
+ return qq{2/system(qq(touch \\x2ftmp\\x2f$marker))};
+}
sub sanitize_tree {
my $data = shift;
meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p3.patch
+27
View File
@@ -0,0 +1,27 @@
From cbd61112415aaa9db84d1af6d0bb3d0f61de8ce0 Mon Sep 17 00:00:00 2001
From: Robert Rothenberg <perl@rhizomnic.com>
Date: Sat, 4 Jul 2026 13:34:20 +0100
Subject: [PATCH] t/40profile.t increase number of tests in the plan
CVE: CVE-2026-14380
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/f94685f415b08ea4b1f183d48430c4583c1c07d0]
(cherry picked from commit f94685f415b08ea4b1f183d48430c4583c1c07d0)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
t/40profile.t | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/t/40profile.t b/t/40profile.t
index d736da7..ba24421 100644
--- a/t/40profile.t
+++ b/t/40profile.t
@@ -31,7 +31,7 @@ BEGIN {
if $Config{osvers} =~ /xen/ # eg 2.6.18-4-xen-amd64
and $ENV{AUTOMATED_TESTING};
- plan tests => 60;
+ plan tests => 61;
}
$Data::Dumper::Indent = 1;
meta-oe/recipes-devtools/perl/libdbi-perl/CVE-2026-14380_p4.patch
+56
View File
@@ -0,0 +1,56 @@
From ef28126fbb8d918307b4995030028984ff8796f5 Mon Sep 17 00:00:00 2001
From: Robert Rothenberg <perl@rhizomnic.com>
Date: Mon, 6 Jul 2026 09:13:26 +0100
Subject: [PATCH] Improve CVE-2026-14380 tests for Profile
CVE: CVE-2026-14380
Upstream-Status: Backport [https://github.com/perl5-dbi/dbi/commit/7949e551b3c7a8854926b6de84f6cc2ceafb2200]
(cherry picked from commit 7949e551b3c7a8854926b6de84f6cc2ceafb2200)
Signed-off-by: Hetvi Thakar <hthakar@cisco.com>
---
t/40profile.t | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/t/40profile.t b/t/40profile.t
index 5c72449..d736da7 100644
--- a/t/40profile.t
+++ b/t/40profile.t
@@ -461,31 +461,34 @@ is($total_time, 2.93, 'merged nodes foo/bar time');
subtest "CVE-2026-14380" => sub {
{
- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
+ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 1);
local $ENV{DBI_PROFILE} = payload_for($marker);
my $dbh = eval {
DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 })
};
ok !( -e "/tmp/$marker" ), "ENV DBI_PROFILE payload";
+ unlink "/tmp/$marker" if -e "/tmp/$marker";
}
{
- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
+ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 2);
my $dbh = DBI->connect("dbi:Sponge:", "", "", { RaiseError => 0 });
eval {
$dbh->{Profile} = payload_for($marker);
};
ok !( -e "/tmp/$marker" ), "Set Profile payload";
+ unlink "/tmp/$marker" if -e "/tmp/$marker";
}
{
- my $marker = sprintf('dbi-test-payload-%u-%u-%u', time, $$, 1);
+ my $marker = sprintf('dbi-test-payload-%1.6f-%u-%u-%u', $], time, $$, 3);
my $payload = payload_for($marker);
my $dsn = "dbi:Sponge(Profile=>$payload):";
my $dbh = eval {
DBI->connect($dsn, "", "", { RaiseError => 0 })
};
ok !( -e "/tmp/$marker" ), "DSN payload";
+ unlink "/tmp/$marker" if -e "/tmp/$marker";
}
};
meta-oe/recipes-devtools/perl/libdbi-perl_1.643.bb
+5
View File
@@ -13,6 +13,10 @@ SRC_URI = "http://search.cpan.org/CPAN/authors/id/T/TI/TIMB/DBI-${PV}.tar.gz \
file://CVE-2014-10402.patch \
file://CVE-2026-9698.patch \
file://CVE-2026-10879.patch \
file://CVE-2026-14380_p1.patch \
file://CVE-2026-14380_p2.patch \
file://CVE-2026-14380_p3.patch \
file://CVE-2026-14380_p4.patch \
"
SRC_URI[md5sum] = "352f80b1e23769c116082a90905d7398"
SRC_URI[sha256sum] = "8a2b993db560a2c373c174ee976a51027dd780ec766ae17620c20393d2e836fa"
@@ -43,6 +47,7 @@ RDEPENDS:${PN}:class-target = " \
perl-module-exporter-heavy \
perl-module-dynaloader \
perl-module-io-dir \
perl-module-load \
perl-module-scalar-util \
perl-module-universal \
"