Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1251690

Bug#1108676: unblock/pre-approval: perl / CVE-2025-40909

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
User: release.debian.org@packages.debian.org
Usertags: unblock
X-Debbugs-Cc: perl@packages.debian.org, perl@packages.debian.org
Control: affects -1 + src:perl

Hi, please consider pre-approving the changes in perl/5.40.1-4
in experimental for sid/trixie.

This fixes #1098226 / CVE-2025-40909, a working directory race condition
during thread creation.

The severity was a bit questionable at first, but it's now considered a
proper security issue. Upstream will be releasing updates for supported
versions (5.40 and I believe 5.38 too). So I think we should follow suit.
I intend to try and fix this later also for bookworm via a point release.

The fix took a while for upstream to get right, so there's three cherry
picked commits as separate patches. Furthermore, the changes to the
top level Configure script needed two other patches so we can keep the
Configure regeneration machinery working. (See #762638 for the background
on why we have this machinery.)

Unfortunately that means the debdiff is a bit cluttered. For your
convenience, I'm also attaching the squashed version of the changes
(output of ` git diff debian/5.40.1-3 debian/5.40.1-4 ':!debian/' `)
as `perl_5.40.1-4.gitdiff`.

I uploaded this to experimental to get the "sid pseudo-excuses" debci
results. I believe we now have those and no regressions were found.

(I'm not quite sure how to confirm the test coverage, as I see no way
to query test results scheduled by others in the ci.debian.net API.
But a manual check of a random sample found successful tests for
all of them.)

I have also tested rebuilding 5331 packages in sid including all reverse
dependencies of perl and all packages matching 'lib.*perl'. I found no
regressions with those either.

If you're OK with acking this, I plan to upload the current version
unchanged expect for an 'upload to unstable' changelog entry as 5.40.1-5.

Thanks for your work on the release,
-- 
Niko

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1108676: unblock/pre-approval: perl / CVE-2025-40909 Niko Tyni <ntyni@debian.org> - 2025-07-02 22:10 +0200
  Bug#1108676: unblock/pre-approval: perl / CVE-2025-40909 Ivo De Decker <ivodd@debian.org> - 2025-07-03 14:40 +0200
    Bug#1108676: unblock/pre-approval: perl / CVE-2025-40909 Niko Tyni <ntyni@debian.org> - 2025-07-08 16:40 +0200

csiph-web