From 253aeefbb0aa70b39a122227bca0041799d06ec5 Mon Sep 17 00:00:00 2001 From: RHEL Packaging Agent Date: Thu, 30 Jul 2026 10:08:50 +0000 Subject: [PATCH] Fix CVE-2026-9698: stack and buffer overflow in perl-DBI Backport two upstream fixes for CVE-2026-9698 to perl-DBI: - Fix possible stack overflow in XS_DBI_dispatch by replacing a fixed-size char[200] buffer with dynamic newSVpvf() allocation. - Fix buffer overflow in preparse() by increasing the allocation from strlen(statement)*3 to strlen(statement)*6+16 to account for longer placeholder replacements. Both fixes are combined in a single patch file DBI-1.643-Fix-CVE-2026-9698.patch. CVE: CVE-2026-9698 Upstream patches: - https://github.com/perl5-dbi/dbi/commit/bfe5d73c162d2d1f761a639a0aa33aad6a9eb54e.patch - https://github.com/perl5-dbi/dbi/commit/af79036c07aa9a457971c0f4136e37c85dc20978.patch Resolves: RHEL-184983 This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent. Assisted-by: Ymir --- DBI-1.643-Fix-CVE-2026-9698.patch | 60 +++++++++++++++++++++++++++++++ perl-DBI.spec | 9 ++++- 2 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 DBI-1.643-Fix-CVE-2026-9698.patch diff --git a/DBI-1.643-Fix-CVE-2026-9698.patch b/DBI-1.643-Fix-CVE-2026-9698.patch new file mode 100644 index 0000000..49280f9 --- /dev/null +++ b/DBI-1.643-Fix-CVE-2026-9698.patch @@ -0,0 +1,60 @@ +From 84010491705a3d49c23ac93b9086567869bcd920 Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Wed, 27 May 2026 11:16:50 +0200 +Subject: [PATCH 1/2] Fix possible stack overflow (old issue already noted by + Tim) + +--- + DBI.xs | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +diff --git a/DBI.xs b/DBI.xs +index 2cea4ac..c549d15 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -3998,7 +3998,6 @@ XS(XS_DBI_dispatch) + SV **statement_svp = NULL; + const int is_warning = (!SvTRUE(err_sv) && strlen(SvPV_nolen(err_sv))==1); + const char *err_meth_name = meth_name; +- char intro[200]; + + if (meth_type == methtype_set_err) { + SV **sem_svp = hv_fetch((HV*)SvRV(h), "dbi_set_err_method", 18, GV_ADDWARN); +@@ -4006,10 +4005,8 @@ XS(XS_DBI_dispatch) + err_meth_name = SvPV_nolen(*sem_svp); + } + +- /* XXX change to vsprintf into sv directly */ +- sprintf(intro,"%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, +- SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information"); +- msg = sv_2mortal(newSVpv(intro,0)); ++ msg = sv_2mortal(newSVpvf("%s %s %s: ", HvNAME(DBIc_IMP_STASH(imp_xxh)), err_meth_name, ++ SvTRUE(err_sv) ? "failed" : is_warning ? "warning" : "information")); + if (SvOK(DBIc_ERRSTR(imp_xxh))) + sv_catsv(msg, DBIc_ERRSTR(imp_xxh)); + else + +From 963d3dd7d4feae5f1ed43db5021fdf44b60088ff Mon Sep 17 00:00:00 2001 +From: "H.Merijn Brand - Tux" +Date: Thu, 28 May 2026 14:14:50 +0200 +Subject: [PATCH 2/2] Replacing `?` with `:p#` in `preparse ()` with more than + 9 `?` causes buffer overflow + +`:p1` is length 3, `?` just 1, but `:p1003` is length 6! +--- + DBI.xs | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/DBI.xs b/DBI.xs +index c549d15..8858e21 100644 +--- a/DBI.xs ++++ b/DBI.xs +@@ -4201,7 +4201,7 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo) + } + + /* XXX this allocation strategy won't work when we get to more advanced stuff */ +- new_stmt_sv = newSV(strlen(statement) * 3); ++ new_stmt_sv = newSV(strlen(statement) * 6 + 16); + sv_setpv(new_stmt_sv,""); + src = statement; + dest = SvPVX(new_stmt_sv); diff --git a/perl-DBI.spec b/perl-DBI.spec index b5979eb..9a6c2af 100644 --- a/perl-DBI.spec +++ b/perl-DBI.spec @@ -34,11 +34,13 @@ Name: perl-DBI Version: 1.643 -Release: 9%{?dist} +Release: 10%{?dist} Summary: A database access API for perl License: GPL+ or Artistic URL: http://dbi.perl.org/ Source0: https://cpan.metacpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz +# RHEL-184983, CVE-2026-9698, Fix stack overflow and buffer overflow in DBI.xs +Patch0: DBI-1.643-Fix-CVE-2026-9698.patch BuildRequires: coreutils BuildRequires: findutils BuildRequires: gcc @@ -154,6 +156,7 @@ the use of existing DBI frameworks like DBIx::Class. %prep %setup -q -n DBI-%{version} +%patch0 -p1 for F in lib/DBD/Gofer.pm; do iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8" touch -r "$F" "${F}.utf8" @@ -218,6 +221,10 @@ make test %endif %changelog +* Thu Jul 30 2026 RHEL Packaging Agent - 1.643-10 +- Fix stack overflow and buffer overflow in DBI.xs (CVE-2026-9698) + Related: RHEL-184983 + * Mon Aug 09 2021 Mohan Boddu - 1.643-9 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688