Security issues in libdbi-perl

[Guilhem Moulin]

Hi there,

While working on an upload for bookworm LTS I noticed the version of
src:libdbi-perl currently found in trixie is affected by CVE-2026-78030.
(The issue is not dsa-needed.txt currently, but it's not marked as
<no-dsa> either so I don't know yet if this will be fixed via DSA or -pu
upload.)

I see trixie version was recently aligned on sid's to solve the previous
batch of security issues.  If trixie sticks to that version rather than
aligning on sid again then I thought I would point out that 1.653
contains follow-up fixes [0] for vulnerabilities previously fixed hence
might need to be backported as well:

  * https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308
    is a follow-up for CVE-2026-73193
  * https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712
    is a follow-up for CVE-2026-73194
  * https://github.com/perl5-dbi/dbi/commit/7415786b8bf58b1498e9e4f3c8faac7787a057bb
    is a follow-up for CVE-2026-15392

In addition, the unreleased version mentions [1] 2 new security issues:

  * CVE-2026-88815, fixed by
    https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702
  * CVE-2026-88816, fixed by
    https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851

These CVE IDs are not in the security tracker at the moment.  There is
not much information beyond the commits themselves, but AFAICT the
vulnerabilities aren't serious (also the commits are 15 days old and
there is no release yet).

Anyway, I can prepare an upload for the above issues if you'd like :-)

Cheers,
-- 
Guilhem.

[0] https://github.com/perl5-dbi/dbi/compare/1.652...1.653
[1] https://github.com/perl5-dbi/dbi/compare/1.653...master
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-perl-maintainers/attachments/20260924/ffafe7b4/attachment.sig>