Bug#1146808: trixie-pu: package libtie-hash-regex-perl/1.14-3~deb13u1
Salvatore Bonaccorso
carnil at debian.org
Sat Sep 5 19:43:28 BST 2026
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libtie-hash-regex-perl at packages.debian.org, team at security.debian.org, gregoa at debian.org, debian-perl at lists.debian.org, carnil at debian.org
Control: affects -1 + src:libtie-hash-regex-perl
User: release.debian.org at packages.debian.org
Usertags: pu
Hi SRM
This might be considered only for 13.8, as it is late for beeing
accepted. libtie-hash-regex-perl is affected by CVE-2026-77781, marked
as no-dsa.
The package did not got reports back from the same update in unstable,
and passes the debusine QA testing:
https://debusine.debian.net/debian/developers/work-request/1232243/
Regards,
Salvatore
-------------- next part --------------
diff -Nru libtie-hash-regex-perl-1.14/debian/changelog libtie-hash-regex-perl-1.14/debian/changelog
--- libtie-hash-regex-perl-1.14/debian/changelog 2022-10-15 16:59:51.000000000 +0000
+++ libtie-hash-regex-perl-1.14/debian/changelog 2026-09-05 12:19:30.000000000 +0000
@@ -1,3 +1,17 @@
+libtie-hash-regex-perl (1.14-3~deb13u1) trixie; urgency=medium
+
+ * Rebuild for trixie
+
+ -- Salvatore Bonaccorso <carnil at debian.org> Sat, 05 Sep 2026 14:19:30 +0200
+
+libtie-hash-regex-perl (1.14-3) unstable; urgency=medium
+
+ * Team upload.
+ * Tie::Hash::Regex throws an exception on unparseable lookup keys
+ (CVE-2026-77781)
+
+ -- Salvatore Bonaccorso <carnil at debian.org> Sat, 22 Aug 2026 13:56:22 +0200
+
libtie-hash-regex-perl (1.14-2) unstable; urgency=medium
[ Debian Janitor ]
diff -Nru libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch
--- libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch 1970-01-01 00:00:00.000000000 +0000
+++ libtie-hash-regex-perl-1.14/debian/patches/Fix-CVE-2026-77781.patch 2026-09-05 12:19:30.000000000 +0000
@@ -0,0 +1,225 @@
+From: Dave Cross <dave at perlhacks.com>
+Date: Fri, 21 Aug 2026 13:41:51 +0100
+Subject: Fix CVE-2026-77781
+Origin: https://github.com/davorg-cpan/tie-hash-regex/commit/4239732cb76233543e2ded8ff5e0f238af152e0c
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-77781
+
+[Salvatore Bonaccorso: Drop version bump to 2.0.0 in module]
+---
+ Changes | 6 ++
+ lib/Tie/Hash/Regex.pm | 20 ++++--
+ t/cvs-2026-77781.t | 152 ++++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 174 insertions(+), 4 deletions(-)
+ create mode 100644 t/cvs-2026-77781.t
+
+diff --git a/lib/Tie/Hash/Regex.pm b/lib/Tie/Hash/Regex.pm
+index 2b9492cfe473..faffd02356e8 100644
+--- a/lib/Tie/Hash/Regex.pm
++++ b/lib/Tie/Hash/Regex.pm
+@@ -100,7 +100,8 @@ sub FETCH {
+
+ return $self->{$key} if !$is_re && exists $self->{$key};
+
+- $key = qr/$key/ unless $is_re;
++ $key = _compile($key) unless $is_re;
++ return unless defined $key;
+
+ # NOTE: wantarray will _never_ be true when FETCH is called
+ # using the standard hash semantics. I've put that piece
+@@ -130,7 +131,8 @@ sub EXISTS {
+
+ return 1 if !$is_re && exists $self->{$key};
+
+- $key = qr/$key/ unless $is_re;
++ $key = _compile($key) unless $is_re;
++ return unless defined $key;
+
+ /$key/ && return 1 for keys %$self;
+
+@@ -152,7 +154,8 @@ sub DELETE {
+
+ return delete $self->{$key} if !$is_re && exists $self->{$key};
+
+- $key = qr/$key/ unless $is_re;
++ $key = _compile($key) unless $is_re;
++ return unless defined $key;
+
+ for (keys %$self) {
+ if (/$key/) {
+@@ -161,6 +164,15 @@ sub DELETE {
+ }
+ }
+
++sub _compile {
++ my ($key) = @_;
++
++ my $re = eval { qr/$key/ };
++
++ # This will be undef if the "eval" failed
++ return $re;
++}
++
+ 1;
+ __END__
+
+diff --git a/t/cvs-2026-77781.t b/t/cvs-2026-77781.t
+new file mode 100644
+index 000000000000..22a1bcf3b699
+--- /dev/null
++++ b/t/cvs-2026-77781.t
+@@ -0,0 +1,152 @@
++use strict;
++use warnings;
++
++use Test::More;
++
++use Tie::Hash::Regex;
++
++sub fresh {
++ my %h;
++
++ tie %h, 'Tie::Hash::Regex';
++
++ $h{alice} = 'record-A';
++ $h{bob} = 'record-B';
++ $h{carol} = 'record-C';
++
++ return \%h;
++}
++
++#
++# First make sure the normal behaviour still works.
++#
++
++{
++ my $h = fresh();
++
++ is(
++ $h->{alice},
++ 'record-A',
++ 'exact lookup works',
++ );
++
++ is(
++ $h->{'^car'},
++ 'record-C',
++ 'regex lookup works',
++ );
++
++ is(
++ $h->{'^zzz'},
++ undef,
++ 'well-formed regex with no match returns undef',
++ );
++}
++
++#
++# Regression tests for CVE-2026-77781.
++#
++# A malformed regex used as a lookup key should be treated as a
++# non-match, rather than throwing an exception from FETCH, EXISTS
++# or DELETE.
++#
++
++my @payloads = (
++ '(',
++ '[',
++ '*',
++ '+',
++ '?',
++ '\\',
++ '(?<',
++ '(?{',
++);
++
++for my $payload (@payloads) {
++ subtest "malformed pattern '$payload'" => sub {
++ {
++ my $h = fresh();
++
++ my ($value, $error);
++
++ {
++ local $@;
++ eval {
++ $value = $h->{$payload};
++ 1;
++ } or $error = $@;
++ }
++
++ is(
++ $error,
++ undef,
++ 'FETCH does not die',
++ );
++
++ is(
++ $value,
++ undef,
++ 'FETCH treats malformed pattern as no match',
++ );
++ }
++
++ {
++ my $h = fresh();
++
++ my ($exists, $error);
++
++ {
++ local $@;
++ eval {
++ $exists = exists $h->{$payload};
++ 1;
++ } or $error = $@;
++ }
++
++ is(
++ $error,
++ undef,
++ 'EXISTS does not die',
++ );
++
++ ok(
++ !$exists,
++ 'EXISTS treats malformed pattern as no match',
++ );
++ }
++
++ {
++ my $h = fresh();
++
++ my ($deleted, $error);
++
++ {
++ local $@;
++ eval {
++ $deleted = delete $h->{$payload};
++ 1;
++ } or $error = $@;
++ }
++
++ is(
++ $error,
++ undef,
++ 'DELETE does not die',
++ );
++
++ is(
++ $deleted,
++ undef,
++ 'DELETE treats malformed pattern as no match',
++ );
++
++ is_deeply(
++ [sort keys %$h],
++ [qw(alice bob carol)],
++ 'failed DELETE leaves hash unchanged',
++ );
++ }
++ };
++}
++
++done_testing;
+--
+2.55.0
+
diff -Nru libtie-hash-regex-perl-1.14/debian/patches/series libtie-hash-regex-perl-1.14/debian/patches/series
--- libtie-hash-regex-perl-1.14/debian/patches/series 1970-01-01 00:00:00.000000000 +0000
+++ libtie-hash-regex-perl-1.14/debian/patches/series 2026-09-05 12:19:30.000000000 +0000
@@ -0,0 +1 @@
+Fix-CVE-2026-77781.patch
More information about the pkg-perl-maintainers
mailing list