From 9a9101908e332499cd09e5bd86dfba12bbb5a7d2 Mon Sep 17 00:00:00 2001
From: mgb01105731 <mgb01105731@alibaba-inc.com>
Date: Fri, 20 Oct 2023 10:14:58 +0800
Subject: [PATCH] fix CVE-2023-31484

---
 fix-CVE-2023-31484.patch | 44 ++++++++++++++++++++++++++++++++++++++++
 perl.spec                |  6 +++++-
 2 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 fix-CVE-2023-31484.patch

diff --git a/fix-CVE-2023-31484.patch b/fix-CVE-2023-31484.patch
new file mode 100644
index 0000000..cf23983
--- /dev/null
+++ b/fix-CVE-2023-31484.patch
@@ -0,0 +1,44 @@
+diff -Nurw perl-5.36.1/cpan/CPAN/lib/CPAN/HTTP/Client.pm perl-5.36.1_new/cpan/CPAN/lib/CPAN/HTTP/Client.pm
+--- perl-5.36.1/cpan/CPAN/lib/CPAN/HTTP/Client.pm	2023-03-02 19:53:15.000000000 +0800
++++ perl-5.36.1_new/cpan/CPAN/lib/CPAN/HTTP/Client.pm	2023-10-20 10:39:59.523582310 +0800
+@@ -6,7 +6,7 @@
+ use CPAN::HTTP::Credentials;
+ use HTTP::Tiny 0.005;
+ 
+-$CPAN::HTTP::Client::VERSION = $CPAN::HTTP::Client::VERSION = "1.9601";
++$CPAN::HTTP::Client::VERSION = $CPAN::HTTP::Client::VERSION = "1.9602";
+ 
+ # CPAN::HTTP::Client is adapted from parts of cpanm by Tatsuhiko Miyagawa
+ # and parts of LWP by Gisle Aas
+@@ -32,6 +32,7 @@
+ 
+     my $want_proxy = $self->_want_proxy($uri);
+     my $http = HTTP::Tiny->new(
++        verify_SSL => 1,
+         $want_proxy ? (proxy => $self->{proxy}) : ()
+     );
+ 
+diff -Nurw perl-5.36.1/cpan/CPAN/lib/CPAN.pm perl-5.36.1_new/cpan/CPAN/lib/CPAN.pm
+--- perl-5.36.1/cpan/CPAN/lib/CPAN.pm	2023-03-02 19:53:45.000000000 +0800
++++ perl-5.36.1_new/cpan/CPAN/lib/CPAN.pm	2023-10-20 10:38:26.852642384 +0800
+@@ -2,7 +2,7 @@
+ # vim: ts=4 sts=4 sw=4:
+ use strict;
+ package CPAN;
+-$CPAN::VERSION = '2.33';
++$CPAN::VERSION = '2.36';
+ $CPAN::VERSION =~ s/_//;
+ 
+ # we need to run chdir all over and we would get at wrong libraries
+diff -Nurw perl-5.36.1/Porting/Maintainers.pl perl-5.36.1_new/Porting/Maintainers.pl
+--- perl-5.36.1/Porting/Maintainers.pl	2023-04-10 20:20:14.000000000 +0800
++++ perl-5.36.1_new/Porting/Maintainers.pl	2023-10-20 10:37:42.978144249 +0800
+@@ -250,7 +250,7 @@
+     },
+ 
+     'CPAN' => {
+-        'DISTRIBUTION' => 'ANDK/CPAN-2.33-TRIAL.tar.gz',
++        'DISTRIBUTION' => 'ANDK/CPAN-2.36.tar.gz',
+         'FILES'        => q[cpan/CPAN],
+         'EXCLUDED'     => [
+             qr{^distroprefs/},
diff --git a/perl.spec b/perl.spec
index 0caa2f1..25d9793 100644
--- a/perl.spec
+++ b/perl.spec
@@ -1,5 +1,5 @@
 # anolis_release number must be even higher, because dual-lived modules will be broken otherwise
-%define anolis_release 11
+%define anolis_release 12
 
 %global perl_version    5.36.1
 %global perl_epoch      4
@@ -65,6 +65,7 @@ Patch13:        perl-5.28.0-Pass-CFLAGS-to-dtrace.patch
 Patch200:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
 Patch201:       perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-MM-on-Linux.patch
 Patch202:       perl-5.36.0-Add-definition-of-OPTIMIZE-to-.ph-files.patch
+Patch203:       fix-CVE-2023-31484.patch
 
 BuildRequires:  bash bzip2-devel coreutils findutils gcc glibc-common make
 BuildRequires:  sed tar zlib-devel
@@ -2576,6 +2577,9 @@ LC_ALL=C TEST_JOBS=$JOBS make test_harness
 %{_mandir}/man3/vmsish.*
 
 %changelog
+* Fri Oct 20 2023 mgb01105731 <mgb01105731@alibaba-inc.com> - 5.36.1-12
+- fix CVE-2023-31484
+
 * Tue Jul 11 2023 Funda Wang <fundawang@yeah.net> - 5.36.1-11
 - New version 5.36.1
 
-- 
Gitee