[From nobody Mon Oct 5 23:01:09 2026 Received: (at submit) by bugs.debian.org; 5 Oct 2026 15:25:58 +0000 X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02 (2024-03-25) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-107.3 required=4.0 tests=ALL_TRUSTED,BAYES_00, DKIMWL_WL_HIGH,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, FOURLA,FROMDEVELOPER,SPF_HELO_NONE,SPF_PASS,USER_IN_DKIM_WELCOMELIST autolearn=ham autolearn_force=no version=4.0.1-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 31; hammy, 150; neutral, 58; spammy, 0. spammytokens: hammytokens:0.000-+--Hx-spam-relays-external:sk:stravin, 0.000-+--H*RT:sk:stravin, 0.000-+--Hx-spam-relays-external:311, 0.000-+--H*RT:311, 0.000-+--H*RT:108 Return-path: <carnil@debian.org> Received: from stravinsky.debian.org ([2001:41b8:202:deb::311:108]:36212) by buxtehude.debian.org with esmtps (TLS1.3:ECDHE_SECP256R1__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xDkZi-00ENuM-1b for submit@bugs.debian.org; Mon, 05 Oct 2026 15:25:58 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.stravinsky; h=X-Debian-User:Content-Type:MIME-Version:Message-ID: Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding:Content-ID: Content-Description:In-Reply-To:References; bh=MPL2OgCVUQ3ait1v0vgE9ezXz407TJ9u+l6yYS5+LCI=; b=mM98lvqUKWpDjn24orSj+fyA5+ ImqsS8xgWZwULWW8gxgpJdU7fEdC3e2PWtBapgqYmvHD5s2EMCMXKPuhcXQyeU379FmNuB3r0Z1xX uO3goHdIm3+iUkXoVOaWy0HPBdt+2Eyx12Uv8sNPOAJS/ZnTb24RabrWZJk6ofyLPL7Nqgf32sLYl t0jS9Mk4yMSyN7t98iozrnyscJ25Sx2XZSRxG+rt/SKfJUjqgngydcsQZJo3/A1Z0LD1qQBYAdx2s C1qjP81G6RQsIu10Lhk/M0qpg99LxouGIosdPz+3QsVxAlp7IHUgtDBvW4C7x4m0/szV9cuJEHVei 4U6w4JFA==; Received: from authenticated-user by stravinsky.debian.org with esmtpsa (TLS1.3:ECDHE_X25519__RSA_PSS_RSAE_SHA256__AES_256_GCM:256) (Exim 4.96) (envelope-from <carnil@debian.org>) id 1xDkZf-003Hy4-28 for submit@bugs.debian.org; Mon, 05 Oct 2026 15:25:57 +0000 Received: by eldamar.lan (Postfix, from userid 1000) id A67A5DC0897; Mon, 05 Oct 2026 17:25:54 +0200 (CEST) Date: Mon, 5 Oct 2026 17:25:54 +0200 From: Salvatore Bonaccorso <carnil@debian.org> To: submit@bugs.debian.org Subject: libnet-whois-raw-perl: CVE-2026-19954 Message-ID: <asPBglAfM87CYQDB@eldamar.lan> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Debian-User: carnil Delivered-To: submit@bugs.debian.org Source: libnet-whois-raw-perl Version: 2.99043-1 X-Debbugs-CC: team@security.debian.org Severity: important Tags: security upstream Hi, The following vulnerability was published for libnet-whois-raw-perl. CVE-2026-19954[0]: | Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois | command-line tool that queries WHOIS for the wrong domain for | unicode domain names. pwhois encodes each non-ASCII label directly | using Net::IDN::Punycode and prepends xn--. Apart from lowercasing | ASCII and Cyrillic letters, it skips the IDNA mapping and | normalization steps, so a label with other uppercase letters, or not | in NFC, encodes to a different A-label than its IDNA form. For | example, a label of U+00C9 followed by "cole" encodes to "xn--cole- | pka" rather than "xn--cole-9oa". The Net::Whois::Raw library | modules are not affected. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-19954 https://www.cve.org/CVERecord?id=CVE-2026-19954 [1] https://github.com/regru/Net-Whois-Raw/issues/34 [2] https://github.com/regru/Net-Whois-Raw/pull/35 [3] https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch Please adjust the affected versions in the BTS as needed. Regards, Salvatore ]