Security issues in libdbi-perl

[Salvatore Bonaccorso]

Hi Guilhem,

On Thu, Sep 24, 2026 at 05:29:47PM +0200, Guilhem Moulin wrote:
> Hi there,
> 
> While working on an upload for bookworm LTS I noticed the version of
> src:libdbi-perl currently found in trixie is affected by CVE-2026-78030.
> (The issue is not dsa-needed.txt currently, but it's not marked as
> <no-dsa> either so I don't know yet if this will be fixed via DSA or -pu
> upload.)
> 
> I see trixie version was recently aligned on sid's to solve the previous
> batch of security issues.  If trixie sticks to that version rather than
> aligning on sid again then I thought I would point out that 1.653
> contains follow-up fixes [0] for vulnerabilities previously fixed hence
> might need to be backported as well:
> 
>   * https://github.com/perl5-dbi/dbi/commit/afba6751f2acbc1f55ad55aac9f0b58d4f511308
>     is a follow-up for CVE-2026-73193
>   * https://github.com/perl5-dbi/dbi/commit/9ffafab2369d7214f88967645feb3beadb900712
>     is a follow-up for CVE-2026-73194
>   * https://github.com/perl5-dbi/dbi/commit/7415786b8bf58b1498e9e4f3c8faac7787a057bb
>     is a follow-up for CVE-2026-15392
> 
> In addition, the unreleased version mentions [1] 2 new security issues:
> 
>   * CVE-2026-88815, fixed by
>     https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702
>   * CVE-2026-88816, fixed by
>     https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851
> 
> These CVE IDs are not in the security tracker at the moment.  There is
> not much information beyond the commits themselves, but AFAICT the
> vulnerabilities aren't serious (also the commits are 15 days old and
> there is no release yet).
> 
> Anyway, I can prepare an upload for the above issues if you'd like :-)

Thanks for the offer. Generally I plan to either look at those via
next point releases or a DSA, but in case we need help will come back
to you.

Regards,
Salvatore