Fix unsafe string eval in DBI::Profile (CVE-2026-14380)

Resolves: RHEL-211151

DBI-1.643-Fix-CVE-2026-14380.patch

@@ -0,0 +1,31 @@
+From 8bbea1026370d3d026056aac6ae824c96e39b7ff Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Wed, 1 Jul 2026 22:31:56 +0100
+Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380]
+
+---
+ lib/DBI/Profile.pm | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff -u -r DBI-1.641.patched/lib/DBI/Profile.pm DBI-1.641/lib/DBI/Profile.pm
+--- a/lib/DBI/Profile.pm	2026-08-03 13:49:51.868114845 +0200
++++ b/lib/DBI/Profile.pm	2026-08-03 13:51:16.124561338 +0200
+@@ -679,6 +679,7 @@
+ use Exporter ();
+ use UNIVERSAL ();
+ use Carp;
++use Module::Load ();
+ 
+ use DBI qw(dbi_time dbi_profile dbi_profile_merge_nodes dbi_profile_merge);
+ 
+@@ -758,7 +759,9 @@
+         }
+     }
+ 
+-    eval "require $package" if $package; # silently ignores errors
++    eval {
++        Module::Load::load $package if $package; # silently ignores errors
++    };
+     $package ||= $class;
+ 
+     return $package->new(Path => \@Path, @args);

perl-DBI.spec

@@ -34,7 +34,7 @@
 
 Name:           perl-DBI
 Version:        1.641
-Release:        7%{?dist}
+Release:        8%{?dist}
 Summary:        A database access API for perl
 License:        GPL+ or Artistic
 URL:            http://dbi.perl.org/
@@ -43,6 +43,8 @@ Source0:        http://www.cpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz
 Patch0:         DBI-1.641-Fix-CVE-2026-9698.patch
 # RHEL-193298, CVE-2026-14739, Heap overflow when preparsing SQL statements with excessive placeholders
 Patch1:         DBI-1.643-Fix-CVE-2026-14739.patch
+# RHEL-211149, CVE-2026-14380, Fix unsafe string eval in DBI::Profile
+Patch2:         DBI-1.643-Fix-CVE-2026-14380.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -80,6 +82,7 @@ BuildRequires:  perl(IO::File)
 BuildRequires:  perl(IO::Select)
 BuildRequires:  perl(IPC::Open3)
 BuildRequires:  perl(Math::BigInt)
+BuildRequires:  perl(Module::Load)
 BuildRequires:  perl(Scalar::Util)
 BuildRequires:  perl(Storable)
 BuildRequires:  perl(Symbol)
@@ -160,6 +163,7 @@ the use of existing DBI frameworks like DBIx::Class.
 %setup -q -n DBI-%{version} 
 %patch -P0 -p1
 %patch -P1 -p1
+%patch -P2 -p1
 for F in lib/DBD/Gofer.pm; do
     iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8"
     touch -r "$F" "${F}.utf8"
@@ -223,6 +227,10 @@ make test
 %endif
 
 %changelog
+* Mon Aug 03 2026 Michal Josef Špaček <mspacek@redhat.com> - 1.641-8
+- Fix unsafe string eval in DBI::Profile (CVE-2026-14380)
+  Resolves: RHEL-211151
+
 * Tue Jul 28 2026 Michal Josef Špaček <mspacek@redhat.com> - 1.641-7
 - Fix patch.