import UBI perl-DBI-1.643-9.el9_8.3

SOURCES/DBI-1.643-Fix-CVE-2026-14380.patch

@@ -0,0 +1,25 @@
+From 8bbea1026370d3d026056aac6ae824c96e39b7ff Mon Sep 17 00:00:00 2001
+From: Robert Rothenberg <perl@rhizomnic.com>
+Date: Wed, 1 Jul 2026 22:31:56 +0100
+Subject: [PATCH] Load profile packages using Module::Load [CVE-2026-14380]
+
+---
+ lib/DBI/Profile.pm | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/lib/DBI/Profile.pm b/lib/DBI/Profile.pm
+index f2cc886..6d27b6e 100644
+--- a/lib/DBI/Profile.pm
++++ b/lib/DBI/Profile.pm
+@@ -758,7 +758,10 @@ sub _auto_new {
+         }
+     }
+ 
+-    eval "require $package" if $package; # silently ignores errors
++    if ($package) {
++        (my $file = "$package.pm") =~ s{::}{/}g;
++        eval { require $file }; # silently ignores errors
++    }
+     $package ||= $class;
+ 
+     return $package->new(Path => \@Path, @args);

SOURCES/DBI-1.643-Fix-CVE-2026-14739.patch

@@ -0,0 +1,128 @@
+From 50ccb6ab1306e3f2abb4519920f0d835831f49fc Mon Sep 17 00:00:00 2001
+From: "H.Merijn Brand - Tux" <linux@tux.freedom.nl>
+Date: Sat, 4 Jul 2026 11:38:24 +0200
+Subject: [PATCH] Set a hard limit of 99999 on '?' placeholders 
+ (CVE-2026-14739)
+
+---
+ DBI.pm |  6 ++++--
+ DBI.xs | 53 +++++++++++++++++++++++++++++++++--------------------
+ 2 files changed, 37 insertions(+), 22 deletions(-)
+
+diff --git a/DBI.pm b/DBI.pm
+index d62a32d..b988e40 100644
+--- a/DBI.pm
++++ b/DBI.pm
+@@ -7123,7 +7123,8 @@ a ref to an empty hash because they can't pre-determine the names.
+ It is possible that the keys in the hash returned by C<ParamValues>
+ are not exactly the same as those implied by the prepared statement.
+ For example, DBD::Oracle translates 'C<?>' placeholders into 'C<:pN>'
+-where N is a sequence number starting at 1.
++where N is a sequence number starting at C<1> with a hard limit of
++C<99999>.
+ 
+ * Values:
+ 
+@@ -7225,7 +7226,8 @@ integer.
+ It is also possible that the keys in the hash returned by
+ C<ParamArrays> are not exactly the same as those implied by the
+ prepared statement.  For example, DBD::Oracle translates 'C<?>'
+-placeholders into 'C<:pN>' where N is a sequence number starting at 1.
++placeholders into 'C<:pN>' where N is a sequence number starting at
++C<1> with a hard limit of C<99999>.
+ 
+ =head3 C<RowsInCache>
+ 
+diff --git a/DBI.xs b/DBI.xs
+index 8858e21..23ad34a 100644
+--- a/DBI.xs
++++ b/DBI.xs
+@@ -4201,7 +4201,14 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+     }
+ 
+     /* XXX this allocation strategy won't work when we get to more advanced stuff */
+-    new_stmt_sv = newSV(strlen(statement) * 6 + 16);
++    /* The 7 is for length increase from '?' (length 1) to :p99999 (length 7)
++     * which imposes a limit of 99999 '?' placeholders POSIX style. Actual counts
++     * are a bit higher:
++     * using factor 5: :p1 .. :p1107
++     * using factor 6: :p1 .. :p11106
++     * using factor 7: :p1 .. :p111105
++     * and that count is insane already */
++    new_stmt_sv = newSV(strlen(statement) * 7 + 16);
+     sv_setpv(new_stmt_sv,"");
+     src  = statement;
+     dest = SvPVX(new_stmt_sv);
+@@ -4340,9 +4347,9 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+             continue;
+         }
+ 
+-       if (    !(*src==':' && (PS_accept(DBIpp_ph_cn) || PS_accept(DBIpp_ph_cs)))
+-           &&  !(*src=='?' &&  PS_accept(DBIpp_ph_qm))
+-       ){
++        if (    !(*src==':' && (PS_accept(DBIpp_ph_cn) || PS_accept(DBIpp_ph_cs)))
++            &&  !(*src=='?' &&  PS_accept(DBIpp_ph_qm))
++        ){
+             if (*src == '\'' || *src == '"')
+                 in_quote = *src;
+             *dest++ = *src++;
+@@ -4361,12 +4368,18 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+             if (PS_return(DBIpp_ph_qm))
+                 ;
+             else if (PS_return(DBIpp_ph_cn)) { /* '?' -> ':p1' (etc) */
++                if (idx >= 99999) {
++                    char buf[99];
++                    sprintf(buf, "preparse found more than 99999 '?' placeholders. Limit exceeded.");
++                    set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
++                    return &PL_sv_undef;
++                }
+                 sprintf(start,":p%d", idx++);
+                 dest = start+strlen(start);
+             }
+             else if (PS_return(DBIpp_ph_sp)) { /* '?' -> '%s' */
+-                   *start  = '%';
+-                   *dest++ = 's';
++                *start  = '%';
++                *dest++ = 's';
+             }
+         }
+         else if (isDIGIT(*src)) {   /* :1 */
+@@ -4374,24 +4387,24 @@ preparse(SV *dbh, const char *statement, IV ps_return, IV ps_accept, void *foo)
+             style = ":1";
+ 
+             if (PS_return(DBIpp_ph_cn)) { /* ':1'->':p1'  */
+-                   idx = pln;
+-                   *dest++ = 'p';
+-                   while(isDIGIT(*src))
+-                       *dest++ = *src++;
++                idx = pln;
++                *dest++ = 'p';
++                while(isDIGIT(*src))
++                    *dest++ = *src++;
+             }
+             else if (PS_return(DBIpp_ph_qm) /* ':1' -> '?'  */
+                  ||  PS_return(DBIpp_ph_sp) /* ':1' -> '%s' */
+             ) {
+-                   PS_return(DBIpp_ph_qm) ? sprintf(start,"?") : sprintf(start,"%%s");
+-                   dest = start + strlen(start);
+-                   if (pln != idx) {
+-                        char buf[99];
+-                        sprintf(buf, "preparse found placeholder :%d out of sequence, expected :%d", pln, idx);
+-                        set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
+-                        return &PL_sv_undef;
+-                   }
+-                   while(isDIGIT(*src)) src++;
+-                   idx++;
++                PS_return(DBIpp_ph_qm) ? sprintf(start,"?") : sprintf(start,"%%s");
++                dest = start + strlen(start);
++                if (pln != idx) {
++                    char buf[99];
++                    sprintf(buf, "preparse found placeholder :%d out of sequence, expected :%d", pln, idx);
++                    set_err_char(dbh, imp_xxh, "1", 1, buf, 0, "preparse");
++                    return &PL_sv_undef;
++                }
++                while(isDIGIT(*src)) src++;
++                idx++;
+             }
+         }
+         else if (isALNUM(*src))         /* :name */

SPECS/perl-DBI.spec

@@ -34,13 +34,17 @@
 
 Name:           perl-DBI
 Version:        1.643
-Release:        9%{?dist}.1
+Release:        9%{?dist}.3
 Summary:        A database access API for perl
 License:        GPL+ or Artistic
 URL:            http://dbi.perl.org/
 Source0:        https://cpan.metacpan.org/authors/id/T/TI/TIMB/DBI-%{version}.tar.gz
 # RHEL-184984, CVE-2026-9698, Fix possible stack overflow and buffer overflow in DBI.xs
 Patch0:         DBI-1.643-Fix-CVE-2026-9698.patch
+# RHEL-193306, CVE-2026-14739, Set a hard limit of 99999 on '?' placeholders
+Patch1:         DBI-1.643-Fix-CVE-2026-14739.patch
+# RHEL-211149, CVE-2026-14380, Fix unsafe string eval in DBI::Profile
+Patch2:         DBI-1.643-Fix-CVE-2026-14380.patch
 BuildRequires:  coreutils
 BuildRequires:  findutils
 BuildRequires:  gcc
@@ -157,6 +161,8 @@ the use of existing DBI frameworks like DBIx::Class.
 %prep
 %setup -q -n DBI-%{version} 
 %patch0 -p1
+%patch1 -p1
+%patch2 -p1
 for F in lib/DBD/Gofer.pm; do
     iconv -f ISO-8859-1 -t UTF-8 < "$F" > "${F}.utf8"
     touch -r "$F" "${F}.utf8"
@@ -221,6 +227,14 @@ make test
 %endif
 
 %changelog
+* Thu Jul 16 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.643-9.3
+- Fix unsafe string eval in DBI::Profile (CVE-2026-14380)
+- Resolves: RHEL-211149
+
+* Fri Jul 10 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.643-9.2
+- Set a hard limit of 99999 on '?' placeholders (CVE-2026-14739)
+- Resolves: RHEL-193306
+
 * Thu Jun 18 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.643-9.1
 - Fix possible stack overflow and buffer overflow in DBI.xs
   (CVE-2026-9698)