Compare commits
No commits in common. "c8s" and "c9-beta" have entirely different histories.
@ -1 +0,0 @@
|
||||
1
|
||||
3
.gitignore
vendored
3
.gitignore
vendored
@ -1,2 +1 @@
|
||||
SOURCES/Date-Manip-6.60.tar.gz
|
||||
/Date-Manip-6.60.tar.gz
|
||||
SOURCES/Date-Manip-6.85.tar.gz
|
||||
|
||||
1
.perl-Date-Manip.metadata
Normal file
1
.perl-Date-Manip.metadata
Normal file
@ -0,0 +1 @@
|
||||
c3711e7ac006cb1d026042ec81b604c0979180a7 SOURCES/Date-Manip-6.85.tar.gz
|
||||
@ -1,38 +1,42 @@
|
||||
Name: perl-Date-Manip
|
||||
Version: 6.60
|
||||
Release: 3%{?dist}.1
|
||||
Version: 6.85
|
||||
Release: 3%{?dist}
|
||||
Summary: Date manipulation routines
|
||||
Group: Development/Libraries
|
||||
License: GPL+ or Artistic
|
||||
URL: http://search.cpan.org/dist/Date-Manip/
|
||||
Source0: http://www.cpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
|
||||
# https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch
|
||||
Patch0: perl-Date-Manip-6.60-CVE-2026-60075.patch
|
||||
URL: https://metacpan.org/release/Date-Manip
|
||||
Source0: https://cpan.metacpan.org/authors/id/S/SB/SBECK/Date-Manip-%{version}.tar.gz
|
||||
BuildArch: noarch
|
||||
# Build
|
||||
BuildRequires: coreutils
|
||||
BuildRequires: make
|
||||
BuildRequires: perl-interpreter
|
||||
BuildRequires: perl-generators
|
||||
BuildRequires: perl(Config)
|
||||
BuildRequires: perl-interpreter
|
||||
BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76
|
||||
BuildRequires: perl(strict)
|
||||
BuildRequires: perl(warnings)
|
||||
# Runtime
|
||||
BuildRequires: perl(:VERSION) >= 5.10.0
|
||||
BuildRequires: perl(Carp)
|
||||
# XXX: BuildRequires: perl(Cwd)
|
||||
# XXX: BuildRequires: perl(Data::Dumper)
|
||||
# Cwd not used at tests
|
||||
BuildRequires: perl(Data::Dumper)
|
||||
BuildRequires: perl(Encode)
|
||||
BuildRequires: perl(Exporter)
|
||||
# XXX: BuildRequires: perl(File::Find)
|
||||
# XXX: BuildRequires: perl(File::Spec)
|
||||
# File::Find not used at tests
|
||||
# File::Spec not used at tests
|
||||
BuildRequires: perl(integer)
|
||||
BuildRequires: perl(IO::File)
|
||||
BuildRequires: perl(Storable)
|
||||
BuildRequires: perl(utf8)
|
||||
# Win32::TieRegistry not used
|
||||
# Tests only
|
||||
BuildRequires: perl(Test::Inter)
|
||||
# File::Basename not used
|
||||
# File::Find::Rule not used
|
||||
# lib not used
|
||||
BuildRequires: perl(Test::Inter) >= 1.09
|
||||
BuildRequires: perl(Test::More)
|
||||
Requires: perl-libs
|
||||
# Test::Pod 1.00 not used
|
||||
# Test::Pod::Coverage 1.00 not used
|
||||
Requires: perl(:MODULE_COMPAT_%(eval "$(perl -V:version)"; echo $version))
|
||||
Requires: perl(Cwd)
|
||||
Requires: perl(File::Find)
|
||||
Requires: perl(File::Spec)
|
||||
@ -45,51 +49,28 @@ Obsoletes: perl-DateManip < 5.48-1
|
||||
|
||||
%description
|
||||
Date::Manip is a series of modules designed to make any common date/time
|
||||
operation easy to do. Operations such as comparing two times, determining a
|
||||
data a given amount of time from another, or parsing international times
|
||||
operation easy to do. Operations such as comparing two times, determining
|
||||
a data a given amount of time from another, or parsing international times
|
||||
are all easily done. It deals with time as it is used in the Gregorian
|
||||
calendar (the one currently in use) with full support for time changes due
|
||||
to daylight saving time.
|
||||
|
||||
%package tests
|
||||
Summary: Tests for %{name}
|
||||
Requires: %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
|
||||
Requires: perl-Test-Harness
|
||||
|
||||
%description tests
|
||||
Tests from %{name}. Execute them
|
||||
with "%{_libexecdir}/%{name}/test".
|
||||
|
||||
%prep
|
||||
%setup -q -n Date-Manip-%{version}
|
||||
%patch0 -p1
|
||||
|
||||
# Help generators to recognize Perl scripts
|
||||
for F in t/*.t; do
|
||||
perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F"
|
||||
chmod +x "$F"
|
||||
done
|
||||
|
||||
%build
|
||||
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1
|
||||
make %{?_smp_mflags}
|
||||
perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1
|
||||
%{make_build}
|
||||
|
||||
%install
|
||||
make pure_install DESTDIR=%{buildroot}
|
||||
%{make_install}
|
||||
%{_fixperms} %{buildroot}/*
|
||||
|
||||
# Install tests
|
||||
mkdir -p %{buildroot}%{_libexecdir}/%{name}
|
||||
cp -a t %{buildroot}%{_libexecdir}/%{name}
|
||||
# Remove release tests
|
||||
rm -f %{buildroot}%{_libexecdir}/%{name}/t/pod*
|
||||
cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
|
||||
#!/bin/sh
|
||||
cd %{_libexecdir}/%{name} && exec prove -I . -j "$(getconf _NPROCESSORS_ONLN)"
|
||||
EOF
|
||||
chmod +x %{buildroot}%{_libexecdir}/%{name}/test
|
||||
|
||||
%check
|
||||
unset DATE_MANIP DATE_MANIP_DEBUG DATE_MANIP_DEBUG_ABBREVS \
|
||||
DATE_MANIP_DEBUG_ZONES DATE_MANIP_TEST_DM5 OS MULTINET_TIMEZONE \
|
||||
RELEASE_TESTING 'SYS$TIMEZONE_DIFFERENTIAL' 'SYS$TIMEZONE_NAME' \
|
||||
'SYS$TIMEZONE_RULE' 'TCPIP$TZ' 'UCX$TZ'
|
||||
make test
|
||||
|
||||
%files
|
||||
@ -99,19 +80,82 @@ make test
|
||||
%{_mandir}/man[13]/*.[13]*
|
||||
%{_bindir}/dm_*
|
||||
|
||||
%files tests
|
||||
%{_libexecdir}/%{name}
|
||||
|
||||
%changelog
|
||||
* Thu Aug 13 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 6.60-3.1
|
||||
- Fix CVE-2026-60075: prevent ReDoS via crafted strings with long
|
||||
interior whitespace runs in date/time parsing
|
||||
- Resolves: RHEL-239807
|
||||
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 6.85-3
|
||||
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
||||
Related: rhbz#1991688
|
||||
|
||||
* Thu Jul 20 2023 Jitka Plesnikova <jplesnik@redhat.com> - 6.60-3
|
||||
- Replace versioned MODULE_COMPAT by non-versioned perl-libs
|
||||
- Package tests
|
||||
- Resolves: rhbz#2219504
|
||||
* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 6.85-2
|
||||
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
||||
|
||||
* Tue Mar 03 2021 Jan Pazdziora <jpazdziora@redhat.com> - 6.85-1
|
||||
- 1933868 - Rebase to upstream version 6.85.
|
||||
|
||||
* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 6.83-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
|
||||
|
||||
* Fri Jan 15 2021 Petr Pisar <ppisar@redhat.com> - 6.83-2
|
||||
- Specify all dependendencies
|
||||
|
||||
* Tue Dec 15 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.83-1
|
||||
- 1902872 - Rebase to upstream version 6.83.
|
||||
|
||||
* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.82-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Tue Jun 23 2020 Jitka Plesnikova <jplesnik@redhat.com> - 6.82-2
|
||||
- Perl 5.32 rebuild
|
||||
|
||||
* Mon Jun 08 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.82-1
|
||||
- 1842524 - Rebase to upstream version 6.82.
|
||||
|
||||
* Mon Apr 27 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.81-1
|
||||
- 1827253 - Rebase to upstream version 6.81.
|
||||
|
||||
* Tue Mar 03 2020 Jan Pazdziora <jpazdziora@redhat.com> - 6.80-1
|
||||
- 1809202 - Rebase to upstream version 6.80.
|
||||
|
||||
* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 6.79-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Mon Dec 09 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.79-1
|
||||
- 1778849 - Rebase to upstream version 6.79.
|
||||
|
||||
* Mon Sep 02 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.78-1
|
||||
- 1747170 - Rebase to upstream version 6.78.
|
||||
|
||||
* Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.77-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Thu Jun 06 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.77-1
|
||||
- 1716417 - Rebase to upstream version 6.77.
|
||||
|
||||
* Fri May 31 2019 Jitka Plesnikova <jplesnik@redhat.com> - 6.76-2
|
||||
- Perl 5.30 rebuild
|
||||
|
||||
* Mon Mar 04 2019 Jan Pazdziora <jpazdziora@redhat.com> - 6.76-1
|
||||
- 1684273 - Rebase to upstream version 6.76.
|
||||
|
||||
* Fri Feb 01 2019 Fedora Release Engineering <releng@fedoraproject.org> - 6.75-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Mon Dec 10 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.75-1
|
||||
- 1656324 - Rebase to upstream version 6.75.
|
||||
|
||||
* Mon Sep 10 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.73-1
|
||||
- 1624940 - Rebase to upstream version 6.73.
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.72-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
|
||||
* Thu Jun 28 2018 Jitka Plesnikova <jplesnik@redhat.com> - 6.72-2
|
||||
- Perl 5.28 rebuild
|
||||
|
||||
* Thu Jun 07 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.72-1
|
||||
- 1585345 - Rebase to upstream version 6.72.
|
||||
|
||||
* Fri Mar 02 2018 Jan Pazdziora <jpazdziora@redhat.com> - 6.70-1
|
||||
- 1550748 - Rebase to upstream version 6.70.
|
||||
|
||||
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 6.60-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
|
||||
@ -1,6 +0,0 @@
|
||||
--- !Policy
|
||||
product_versions:
|
||||
- rhel-8
|
||||
decision_context: osci_compose_gate
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
|
||||
@ -1,69 +0,0 @@
|
||||
From 86c3aa6b43e0b311c3aa5e80e58ab51ab525feb3 Mon Sep 17 00:00:00 2001
|
||||
From: CPANSec Security Scanner Bot <cpan-security@security.metacpan.org>
|
||||
Date: Thu, 13 Aug 2026 13:52:54 +0000
|
||||
Subject: [PATCH] Date::Manip: cap the length of a string handed to the parsers
|
||||
|
||||
CVE-2026-60075. _parse_time removes a time from anywhere in the string
|
||||
with the unanchored substitution s/$timerx/ /, where $timerx is an
|
||||
auto-generated alternation of time patterns reached through a leading
|
||||
(?:$atrx|^|\s+). The engine retries the match at every position of an
|
||||
interior whitespace run: at each start position the leading \s+ consumes
|
||||
the rest of the run greedily, the time alternation fails because the run
|
||||
holds no digits, and the engine backtracks a space at a time across the
|
||||
run before advancing the start position. The cost is quadratic in the
|
||||
length of the run, and no time need be present in the string. On the
|
||||
machine this patch was tested on, parsing "x" . (" " x 2000) . "x" took
|
||||
1.7 seconds of CPU and "x" . (" " x 16000) . "x" took 107 seconds,
|
||||
rising about fourfold for each doubling of the run.
|
||||
|
||||
Fix: reject a string longer than $MAXLENGTH (256) at the parse and
|
||||
parse_time entries, before any regex runs, which is the shape of the fix
|
||||
libwww-perl shipped in HTTP::Date 6.08 for the same weakness class.
|
||||
Legitimate date strings are well under 100 characters, and a 42 entry
|
||||
corpus of legitimate formats parses to the same value before and after.
|
||||
---
|
||||
lib/Date/Manip/Date.pm | 17 +++++++++++++++++
|
||||
1 file changed, 17 insertions(+)
|
||||
|
||||
diff --git a/lib/Date/Manip/Date.pm b/lib/Date/Manip/Date.pm
|
||||
index b954917..f755cab 100644
|
||||
--- a/lib/Date/Manip/Date.pm
|
||||
+++ b/lib/Date/Manip/Date.pm
|
||||
@@ -93,6 +93,13 @@ sub input {
|
||||
# DATE PARSING
|
||||
########################################################################
|
||||
|
||||
+# The longest string the parsers will look at. The time matching
|
||||
+# regexp is applied unanchored, so the cost of failing to match grows
|
||||
+# with the square of the length of an interior whitespace run. Real
|
||||
+# date strings are well under 100 characters.
|
||||
+
|
||||
+our $MAXLENGTH = 256;
|
||||
+
|
||||
sub parse {
|
||||
my($self,$instring,@opts) = @_;
|
||||
$self->_init();
|
||||
@@ -103,6 +110,11 @@ sub parse {
|
||||
return 1;
|
||||
}
|
||||
|
||||
+ if (length($instring) > $MAXLENGTH) {
|
||||
+ $$self{'err'} = '[parse] Date string too long';
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
my %opts = map { $_,1 } @opts;
|
||||
|
||||
my $dmt = $$self{'tz'};
|
||||
@@ -345,6 +357,11 @@ sub parse_time {
|
||||
return 1;
|
||||
}
|
||||
|
||||
+ if (length($string) > $MAXLENGTH) {
|
||||
+ $$self{'err'} = '[parse_time] Time string too long';
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
my($y,$m,$d,$h,$mn,$s);
|
||||
|
||||
if ($$self{'err'}) {
|
||||
@ -1,12 +0,0 @@
|
||||
summary: Private (RHEL) beakerlib tests
|
||||
enabled: false
|
||||
adjust:
|
||||
- when: distro == rhel
|
||||
enabled: true
|
||||
because: private tests are accesible only within rhel pipline
|
||||
discover:
|
||||
- name: rhel
|
||||
how: fmf
|
||||
url: https://pkgs.devel.redhat.com/git/tests/perl-Date-Manip
|
||||
execute:
|
||||
how: tmt
|
||||
@ -1,5 +0,0 @@
|
||||
summary: Sanity tests
|
||||
discover:
|
||||
how: fmf
|
||||
execute:
|
||||
how: tmt
|
||||
1
sources
1
sources
@ -1 +0,0 @@
|
||||
SHA512 (Date-Manip-6.60.tar.gz) = 46ac9696aea04167427957a43de1b44041ea05d3eaf01ffbdbfda9f458b3073f36ec46c9661ac437f96731d0f40aebc206ef385c6c4aff1b147917fc2c89a1cf
|
||||
@ -1,9 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
OUTPUT=`rpm -qR perl-Date-Manip`
|
||||
|
||||
if ! echo "$OUTPUT" | grep -q "MODULE_COMPAT_"; then
|
||||
exit 0
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
@ -1,17 +0,0 @@
|
||||
summary: Test for BZ 2219504
|
||||
component:
|
||||
- perl-Date-Manip
|
||||
require:
|
||||
- bash
|
||||
- perl-Date-Manip
|
||||
test: ./bz_2219504-check.sh
|
||||
enabled: false
|
||||
adjust:
|
||||
- when: distro == centos-stream-8 or distro == rhel-8
|
||||
enabled: true
|
||||
tag:
|
||||
- TestCaseCopy
|
||||
- Tier1
|
||||
tier: '1'
|
||||
extra-nitrate: TC#0615610
|
||||
id: 8cbc566f-9bbb-47ab-a526-0945257a30c6
|
||||
@ -1,10 +0,0 @@
|
||||
summary: Upstream tests
|
||||
component: perl-Date-Manip
|
||||
require: perl-Date-Manip-tests
|
||||
test: /usr/libexec/perl-Date-Manip/test
|
||||
tag:
|
||||
- Tier1
|
||||
- rhel-buildroot
|
||||
tier: '1'
|
||||
extra-nitrate: TC#0615611
|
||||
id: 083fd883-2fc4-426e-aae8-c0274c8e33a7
|
||||
Loading…
Reference in New Issue
Block a user