From fad4bacc77314139c8b923e4ec6db1b7db796729 Mon Sep 17 00:00:00 2001 From: Francois Perrad Date: Sun, 14 Dec 2025 09:47:09 +0100 Subject: [PATCH] package/perl: security bump to version 5.40.3 This commit fixes CVE-2025-40909: Perl threads have a working directory race condition where file operations may target unintended paths. For release notes, see: https://perldoc.perl.org/5.40.3/perl5403delta Fixes: https://www.cve.org/CVERecord?id=CVE-2025-40909 Signed-off-by: Francois Perrad [Julien: add link to cve.org] Signed-off-by: Julien Olivain (cherry picked from commit 61f5e2efcae5ece840a561ad56cdec04dad3a25d) Signed-off-by: Thomas Perale --- package/perl/perl.hash | 12 ++++++------ package/perl/perl.mk | 5 +++-- 2 files changed, 9 insertions(+), 8 deletions(-) diff --git a/package/perl/perl.hash b/package/perl/perl.hash index d581054bb5..0035c448c5 100644 --- a/package/perl/perl.hash +++ b/package/perl/perl.hash @@ -1,10 +1,10 @@ -# Hashes from: https://www.cpan.org/src/5.0/perl-5.40.2.tar.xz.{md5,sha1,sha256}.txt -md5 9ad7a269dc4053cdbeecd4fde444291b perl-5.40.2.tar.xz -sha1 661fe9ee085ca0aec8ddd65e055bee922af12663 perl-5.40.2.tar.xz -sha256 0551c717458e703ef7972307ab19385edfa231198d88998df74e12226abf563b perl-5.40.2.tar.xz +# Hashes from: https://www.cpan.org/src/5.0/perl-5.40.3.tar.xz.{md5,sha1,sha256}.txt +md5 f526a5975a7cc6f53f28326437b1eb39 perl-5.40.3.tar.xz +sha1 7c95250ceff00d649c1f5afa511987a2c4da61d3 perl-5.40.3.tar.xz +sha256 65f63b4763ab6cb9bb3d5731dd10369e1705be3c59be9847d453eb60b349ab43 perl-5.40.3.tar.xz -# Hash from: https://github.com/arsv/perl-cross/releases/download/1.6.2/perl-cross-1.6.2.hash -sha256 131f7496152ee32067dbac2bc9b44b2f582fc778140e545701b3b2faee782f1d perl-cross-1.6.2.tar.gz +# Hash from: https://github.com/arsv/perl-cross/releases/download/1.6.3/perl-cross-1.6.3.hash +sha256 cd57d8f8017727dc7e19cca55e1e9f22664edecf6c9f04c3515ecc13fd88e4f3 perl-cross-1.6.3.tar.gz # Locally calculated sha256 dd90d4f42e4dcadf5a7c09eea0189d93c7b37ae560c91f0f6d5233ed3b9292a2 Artistic diff --git a/package/perl/perl.mk b/package/perl/perl.mk index 34abb734d6..a301b93e46 100644 --- a/package/perl/perl.mk +++ b/package/perl/perl.mk @@ -6,7 +6,7 @@ # When updating the version here, also update utils/scancpan PERL_VERSION_MAJOR = 40 -PERL_VERSION = 5.$(PERL_VERSION_MAJOR).2 +PERL_VERSION = 5.$(PERL_VERSION_MAJOR).3 PERL_SITE = https://www.cpan.org/src/5.0 PERL_SOURCE = perl-$(PERL_VERSION).tar.xz PERL_LICENSE = Artistic or GPL-1.0+ @@ -15,7 +15,7 @@ PERL_CPE_ID_VENDOR = perl PERL_DEPENDENCIES = $(TARGET_NLS_DEPENDENCIES) PERL_INSTALL_STAGING = YES -PERL_CROSS_VERSION = 1.6.2 +PERL_CROSS_VERSION = 1.6.3 # DO NOT refactor with the github helper (the result is not the same) PERL_CROSS_SITE = https://github.com/arsv/perl-cross/releases/download/$(PERL_CROSS_VERSION) PERL_CROSS_SOURCE = perl-cross-$(PERL_CROSS_VERSION).tar.gz @@ -28,6 +28,7 @@ PERL_EXTRA_DOWNLOADS = $(PERL_CROSS_SITE)/$(PERL_CROSS_SOURCE) define PERL_CROSS_EXTRACT $(call suitable-extractor,$(PERL_CROSS_SOURCE)) $(PERL_DL_DIR)/$(PERL_CROSS_SOURCE) | \ $(TAR) --strip-components=1 -C $(@D) $(TAR_OPTIONS) - + mv $(@D)/cnf/diffs/perl5-5.40.2 $(@D)/cnf/diffs/perl5-5.40.3 endef PERL_POST_EXTRACT_HOOKS += PERL_CROSS_EXTRACT