Bug#1146915: trixie-pu: package libyaml-perl/1.31-1+deb13u1

[Salvatore Bonaccorso]

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: libyaml-perl at packages.debian.org, debian-perl at lists.debian.org, team at security.debian.org, gregoa at debian.org, carnil at debian.org
Control: affects -1 + src:libyaml-perl
User: release.debian.org at packages.debian.org
Usertags: pu

Hi SRM,

This is too late for 13.7, but can you please consider it for 13.8.

libyaml-perl is affected by CVE-2026-63676 already fixed in unstable,
which we marked as no-dsa for trixie.

QA testing on debusine was sucessful:
https://debusine.debian.net/debian/developers/work-request/1230385/

Regards,
Salvatore
-------------- next part --------------
diff -Nru libyaml-perl-1.31/debian/changelog libyaml-perl-1.31/debian/changelog
--- libyaml-perl-1.31/debian/changelog	2024-01-01 02:43:19.000000000 +0000
+++ libyaml-perl-1.31/debian/changelog	2026-09-05 09:44:37.000000000 +0000
@@ -1,3 +1,10 @@
+libyaml-perl (1.31-1+deb13u1) trixie; urgency=medium
+
+  * Team upload.
+  * fix: Avoid backtracking leading to exponential load time (CVE-2026-63676)
+
+ -- Salvatore Bonaccorso <carnil at debian.org>  Sat, 05 Sep 2026 11:44:37 +0200
+
 libyaml-perl (1.31-1) unstable; urgency=medium
 
   * Import upstream version 1.31.
diff -Nru libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch
--- libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch	1970-01-01 00:00:00.000000000 +0000
+++ libyaml-perl-1.31/debian/patches/fix-Avoid-backtracking-leading-to-exponential-load-t.patch	2026-09-05 09:44:37.000000000 +0000
@@ -0,0 +1,27 @@
+From: =?UTF-8?q?Tina=20M=C3=BCller?= <tina.mueller at suse.com>
+Date: Sun, 19 Jul 2026 00:12:26 +0200
+Subject: fix: Avoid backtracking leading to exponential load time
+Origin: https://github.com/ingydotnet/yaml-pm/commit/9388c6a02a66db79f9d2b3727b5588272f612cf1
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-63676
+
+Thanks CPANSec!
+---
+ lib/YAML/Loader.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/YAML/Loader.pm b/lib/YAML/Loader.pm
+index b3c9122f2df5..4f73deb65a9b 100644
+--- a/lib/YAML/Loader.pm
++++ b/lib/YAML/Loader.pm
+@@ -615,7 +615,7 @@ sub _parse_implicit {
+     # remove trailing comments and whitespace
+     $value =~ s/^#.*$//;
+     $value =~ s/\s+#.*$//;
+-    $value =~ s/\s*$//;
++    $value =~ s/\s+$//;
+     return $value if $value eq '';
+     return undef if $value =~ /^~$/;
+     return $value
+-- 
+2.55.0
+
diff -Nru libyaml-perl-1.31/debian/patches/series libyaml-perl-1.31/debian/patches/series
--- libyaml-perl-1.31/debian/patches/series	2024-01-01 02:43:19.000000000 +0000
+++ libyaml-perl-1.31/debian/patches/series	2026-09-05 09:44:37.000000000 +0000
@@ -1 +1,2 @@
 ysh-location.patch
+fix-Avoid-backtracking-leading-to-exponential-load-t.patch