[Git][security-tracker-team/security-tracker][master] Reserve DLA-4821-1 for perl

[Arnaud Rebillout (@arnaudr)]

Arnaud Rebillout pushed to branch master at Debian Security Tracker / security-tracker


Commits:
faac311e by Arnaud Rebillout at 2026-10-05T14:55:58+07:00
Reserve DLA-4821-1 for perl

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -141048,14 +141048,12 @@ CVE-2026-42497 (Archive::Tar versions before 3.08 for Perl extract hardlinks to
 	[experimental] - perl 5.44.0-1
 	- perl 5.42.3-1 (bug #1138859)
 	[trixie] - perl 5.40.1-6+deb13u1
-	[bookworm] - perl <postponed> (Minor issue; wait for regressions upstream sorted out)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396457/
 	NOTE: https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 (3.08)
 CVE-2026-42496 (Archive::Tar versions before 3.08 for Perl extract symlinks with attac ...)
 	[experimental] - perl 5.44.0-1
 	- perl 5.42.3-1 (bug #1138860)
 	[trixie] - perl 5.40.1-6+deb13u1
-	[bookworm] - perl <postponed> (Minor issue; wait for regressions upstream sorted out)
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396459/
 	NOTE: https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158 (3.08)
 CVE-2026-48589 (Apache Shiro\u2019s Jakarta EE module used the HTTP Referer header in  ...)
@@ -142197,7 +142195,6 @@ CVE-2026-5091 (Catalyst::Plugin::Authentication versions through 0.10024 for Per
 CVE-2026-8376 (Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5 ...)
 	- perl 5.40.1-8 (bug #1137345)
 	[trixie] - perl 5.40.1-6+deb13u1
-	[bookworm] - perl <no-dsa> (Minor issue; can be fixed in point release)
 	[bullseye] - perl <postponed> (Minor issue; can be fixed in point release)
 	NOTE: https://github.com/Perl/perl5/pull/24433
 	NOTE: https://lists.security.metacpan.org/cve-announce/msg/40396161/


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[05 Oct 2026] DLA-4821-1 perl - security update
+	{CVE-2025-15649 CVE-2026-7010 CVE-2026-7017 CVE-2026-8376 CVE-2026-12087 CVE-2026-13221 CVE-2026-19487 CVE-2026-42496 CVE-2026-42497 CVE-2026-48959 CVE-2026-48962 CVE-2026-57432 CVE-2026-57433}
+	[bookworm] - perl 5.36.0-7+deb12u4
 [05 Oct 2026] DLA-4820-1 node-lodash - security update
 	{CVE-2025-13465 CVE-2026-2950 CVE-2026-4800}
 	[bookworm] - node-lodash 4.17.21+dfsg+~cs8.31.198.20210220-9+deb12u1


=====================================
data/dla-needed.txt
=====================================
@@ -558,10 +558,6 @@ pdfminer
   NOTE: 20260715: CVE-2025-70559 is follow-up fix for CVE-2025-64512
   NOTE: 20260715: Upcoming DSA (Beuc/front-desk)
 --
-perl (arnaudr)
-  NOTE: 20260527: Added by Front-Desk (santiago)
-  NOTE: 20260527: wait for the DSA before releasing
---
 pglogical
   NOTE: 20260805: Added by Front-Desk, due to CVE-2026-50738 (rouca)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/faac311e4236ffc914873454a1253860ab0e5110

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/faac311e4236ffc914873454a1253860ab0e5110
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/4d9bcba1/attachment.htm>