rpms/perl-YAML-Syck
7
0
Fork 0
Code Issues Pull Requests Releases Activity
Fast, lightweight YAML loader and dumper
4 Commits 5 Branches 4 Tags 109 KiB
Diff 100%
39addbca72
Go to file
RHEL Packaging Agent 39addbca72 Fix four libsyck memory-safety CVEs in perl-YAML-Syck 
Backport upstream commit 44c90a10 to fix four libsyck
memory-safety CVEs reachable from YAML::Syck::Load() on
untrusted input:

- CVE-2026-57075: out-of-bounds read in base64 decoder
- CVE-2026-57076: use-after-free of anchor key string
- CVE-2026-57077: out-of-bounds read in lexer newline scan
- CVE-2026-13713: use-after-free / double-free of anchor node

The patch includes per-CVE regression tests under t/cve-*.t.

CVE: CVE-2026-13713
Upstream patches:
 - 44c90a109e.patch
Resolves: RHEL-211926

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-07-20 06:05:39 +00:00
.fmf Resolves: RHEL-156475 - Fix heap buffer overflow in the YAML emitter 2026-03-25 15:24:19 +01:00
plans Resolves: RHEL-156475 - Fix heap buffer overflow in the YAML emitter 2026-03-25 15:24:19 +01:00
.gitignore re-import sources as agreed with the maintainer 2023-06-30 07:31:19 +02:00
.rpmlint re-import sources as agreed with the maintainer 2023-06-30 07:31:19 +02:00
gating.yaml Resolves: RHEL-156475 - Fix heap buffer overflow in the YAML emitter 2026-03-25 15:24:19 +01:00
perl-YAML-Syck.spec Fix four libsyck memory-safety CVEs in perl-YAML-Syck 2026-07-20 06:05:39 +00:00
sources Import rpm: c8s 2023-03-30 16:29:00 -04:00
YAML-Syck-1.30-Fix-RHEL-211926.patch Fix four libsyck memory-safety CVEs in perl-YAML-Syck 2026-07-20 06:05:39 +00:00
YAML-Syck-1.33-Fix-memory-corruption-error.patch Resolves: RHEL-156475 - Fix heap buffer overflow in the YAML emitter 2026-03-25 15:24:19 +01:00
YAML-Syck-1.37-Fix-CVE-2026-4177.patch Resolves: RHEL-156475 - Fix heap buffer overflow in the YAML emitter 2026-03-25 15:24:19 +01:00