diff --git a/CVE-2018-18312-1.patch b/CVE-2018-18312-1.patch index 9c2c7a68d0514a38c57445ebac653030217f8b9a..41ea4674fc7672151939ec5a8efb0abbf1ec1e28 100644 --- a/CVE-2018-18312-1.patch +++ b/CVE-2018-18312-1.patch @@ -1,5 +1,5 @@ --- a/regcomp.c 2018-05-21 20:29:23.000000000 +0800 -+++ b/regcomp-change.c 2019-04-11 09:51:08.493000000 +0800 ++++ b/regcomp.c 2019-04-11 09:51:08.493000000 +0800 @@ -15591,7 +15591,6 @@ redo_curchar: if (UCHARAT(RExC_parse) != ')') vFAIL("Expecting close paren for wrapper for nested extended charclass"); diff --git a/CVE-2018-18312-2.patch b/CVE-2018-18312-2.patch index 8cca75b94bb74a80bef51f7c4462915c0637313d..1a0e80f55e7aaf92df9615ee10c9264919f7228a 100644 --- a/CVE-2018-18312-2.patch +++ b/CVE-2018-18312-2.patch @@ -1,5 +1,5 @@ --- a/t/re/reg_mesg.t 2018-05-21 20:29:23.000000000 +0800 -+++ b/t/re/reg_mesg-change.t 2019-04-11 09:54:59.622000000 +0800 ++++ b/t/re/reg_mesg.t 2019-04-11 09:54:59.622000000 +0800 @@ -122,6 +122,8 @@ my $tab_hex = sprintf "%02X", ord("\t"); # # The first set are those that should be fatal errors. diff --git a/backport-CVE-2020-10543.patch b/backport-CVE-2020-10543.patch new file mode 100644 index 0000000000000000000000000000000000000000..cd026658cd8f2cda24cc4630788287940769cefe --- /dev/null +++ b/backport-CVE-2020-10543.patch @@ -0,0 +1,36 @@ +From ea6af8d23101db9d575ada0fc659eb03cd2177d8 Mon Sep 17 00:00:00 2001 +From: John Lightsey +Date: Wed, 20 Nov 2019 20:02:45 -0600 +Subject: [PATCH] regcomp.c: Prevent integer overflow from nested regex + quantifiers. + +(CVE-2020-10543) On 32bit systems the size calculations for nested regular +expression quantifiers could overflow causing heap memory corruption. + +Fixes: Perl/perl5-security#125 +(cherry picked from commit bfd31397db5dc1a5c5d3e0a1f753a4f89a736e71) + +port from: +https://github.com/perl/perl5/commit/897d1f7fd515b828e4b198d8b8bef76c6faf03ed + +Signed-off-by: Peibao Liu +--- + regcomp.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff -Naur a/regcomp.c b/regcomp.c +--- a/regcomp.c 2020-07-14 14:52:25.197000000 -0400 ++++ b/regcomp.c 2020-07-14 14:56:41.823000000 -0400 +@@ -5181,6 +5181,12 @@ + (void)ReREFCNT_inc(RExC_rx_sv); + } + ++ if ( ( minnext > 0 && mincount >= SSize_t_MAX / minnext ) ++ || min >= SSize_t_MAX - minnext * mincount ) ++ { ++ FAIL("Regexp out of space"); ++ } ++ + min += minnext * mincount; + is_inf_internal |= deltanext == SSize_t_MAX + || (maxcount == REG_INFTY && minnext + deltanext > 0); diff --git a/backport-CVE-2020-10878.patch b/backport-CVE-2020-10878.patch new file mode 100644 index 0000000000000000000000000000000000000000..5723183b27a8e328c6c73b4b81fc55509a39b8c3 --- /dev/null +++ b/backport-CVE-2020-10878.patch @@ -0,0 +1,144 @@ +From 0a320d753fe7fca03df259a4dfd8e641e51edaa8 Mon Sep 17 00:00:00 2001 +From: Hugo van der Sanden +Date: Tue, 18 Feb 2020 13:51:16 +0000 +Subject: [PATCH] study_chunk: extract rck_elide_nothing + +(CVE-2020-10878) + +(cherry picked from commit 93dee06613d4e1428fb10905ce1c3c96f53113dc) +--- + embed.fnc | 1 + + embed.h | 1 + + proto.h | 3 +++ + regcomp.c | 70 ++++++++++++++++++++++++++++++++++--------------------- + 4 files changed, 48 insertions(+), 27 deletions(-) + +diff -Naur a/embed.fnc b/embed.fnc +--- a/embed.fnc 2020-07-14 15:07:54.374000000 -0400 ++++ b/embed.fnc 2020-07-14 15:14:46.619000000 -0400 +@@ -2476,6 +2476,7 @@ + |I32 stopparen|U32 recursed_depth \ + |NULLOK regnode_ssc *and_withp \ + |U32 flags|U32 depth ++Es |void |rck_elide_nothing|NN regnode *node + EsR |SV * |get_ANYOFM_contents|NN const regnode * n + EsRn |U32 |add_data |NN RExC_state_t* const pRExC_state \ + |NN const char* const s|const U32 n +diff -Naur a/embed.h b/embed.h +--- a/embed.h 2020-07-14 15:07:54.399000000 -0400 ++++ b/embed.h 2020-07-14 15:15:08.491000000 -0400 +@@ -1202,6 +1202,7 @@ + #define output_or_return_posix_warnings(a,b,c) S_output_or_return_posix_warnings(aTHX_ a,b,c) + #define parse_lparen_question_flags(a) S_parse_lparen_question_flags(aTHX_ a) + #define populate_ANYOF_from_invlist(a,b) S_populate_ANYOF_from_invlist(aTHX_ a,b) ++#define rck_elide_nothing(a) S_rck_elide_nothing(aTHX_ a) + #define reg(a,b,c,d) S_reg(aTHX_ a,b,c,d) + #define reg2Lanode(a,b,c,d) S_reg2Lanode(aTHX_ a,b,c,d) + #define reg_node(a,b) S_reg_node(aTHX_ a,b) +diff -Naur a/proto.h b/proto.h +--- a/proto.h 2020-07-14 15:07:54.369000000 -0400 ++++ b/proto.h 2020-07-14 15:15:37.435000000 -0400 +@@ -5482,6 +5482,9 @@ + STATIC void S_populate_ANYOF_from_invlist(pTHX_ regnode *node, SV** invlist_ptr); + #define PERL_ARGS_ASSERT_POPULATE_ANYOF_FROM_INVLIST \ + assert(node); assert(invlist_ptr) ++STATIC void S_rck_elide_nothing(pTHX_ regnode *node); ++#define PERL_ARGS_ASSERT_RCK_ELIDE_NOTHING \ ++ assert(node) + PERL_STATIC_NO_RET void S_re_croak2(pTHX_ bool utf8, const char* pat1, const char* pat2, ...) + __attribute__noreturn__; + #define PERL_ARGS_ASSERT_RE_CROAK2 \ +diff -Naur a/regcomp.c b/regcomp.c +--- a/regcomp.c 2020-07-14 15:07:54.394000000 -0400 ++++ b/regcomp.c 2020-07-14 15:17:39.845000000 -0400 +@@ -4178,6 +4178,44 @@ + } while (f); + } + ++/* Follow the next-chain of the current node and optimize away ++ * all the NOTHINGs from it. ++ * */ ++STATIC void ++S_rck_elide_nothing(pTHX_ regnode *node) ++{ ++ dVAR; ++ ++ PERL_ARGS_ASSERT_RCK_ELIDE_NOTHING; ++ ++ if (OP(node) != CURLYX) { ++ const int max = (reg_off_by_arg[OP(node)] ++ ? I32_MAX ++ /* I32 may be smaller than U16 on CRAYs! */ ++ : (I32_MAX < U16_MAX ? I32_MAX : U16_MAX)); ++ int off = (reg_off_by_arg[OP(node)] ? ARG(node) : NEXT_OFF(node)); ++ int noff; ++ regnode *n = node; ++ ++ /* Skip NOTHING and LONGJMP. */ ++ while ( ++ (n = regnext(n)) ++ && ( ++ (PL_regkind[OP(n)] == NOTHING && (noff = NEXT_OFF(n))) ++ || ((OP(n) == LONGJMP) && (noff = ARG(n))) ++ ) ++ && off + noff < max ++ ) { ++ off += noff; ++ } ++ if (reg_off_by_arg[OP(node)]) ++ ARG(node) = off; ++ else ++ NEXT_OFF(node) = off; ++ } ++ return; ++} ++ + /* the return from this sub is the minimum length that could possibly match */ + STATIC SSize_t + S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, +@@ -4277,28 +4315,10 @@ + */ + JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); + +- /* Follow the next-chain of the current node and optimize +- away all the NOTHINGs from it. */ +- if (OP(scan) != CURLYX) { +- const int max = (reg_off_by_arg[OP(scan)] +- ? I32_MAX +- /* I32 may be smaller than U16 on CRAYs! */ +- : (I32_MAX < U16_MAX ? I32_MAX : U16_MAX)); +- int off = (reg_off_by_arg[OP(scan)] ? ARG(scan) : NEXT_OFF(scan)); +- int noff; +- regnode *n = scan; +- +- /* Skip NOTHING and LONGJMP. */ +- while ((n = regnext(n)) +- && ((PL_regkind[OP(n)] == NOTHING && (noff = NEXT_OFF(n))) +- || ((OP(n) == LONGJMP) && (noff = ARG(n)))) +- && off + noff < max) +- off += noff; +- if (reg_off_by_arg[OP(scan)]) +- ARG(scan) = off; +- else +- NEXT_OFF(scan) = off; +- } ++ /* Follow the next-chain of the current node and optimize ++ away all the NOTHINGs from it. ++ */ ++ rck_elide_nothing(scan); + + /* The principal pseudo-switch. Cannot be a switch, since we + look into several different things. */ +@@ -5425,11 +5445,7 @@ + if (data && (fl & SF_HAS_EVAL)) + data->flags |= SF_HAS_EVAL; + optimize_curly_tail: +- if (OP(oscan) != CURLYX) { +- while (PL_regkind[OP(next = regnext(oscan))] == NOTHING +- && NEXT_OFF(next)) +- NEXT_OFF(oscan) += NEXT_OFF(next); +- } ++ rck_elide_nothing(oscan); + continue; + + default: diff --git a/backport-CVE-2020-12723.patch b/backport-CVE-2020-12723.patch new file mode 100644 index 0000000000000000000000000000000000000000..6e921af450c72ff2b70b3796437d154b4313e14a --- /dev/null +++ b/backport-CVE-2020-12723.patch @@ -0,0 +1,277 @@ +From c0b79e3c354b25f9fb732bd49f668ae5eeaa723a Mon Sep 17 00:00:00 2001 +From: Hugo van der Sanden +Date: Sat, 11 Apr 2020 14:10:24 +0100 +Subject: [PATCH] study_chunk: avoid mutating regexp program within GOSUB + +gh16947 and gh17743: studying GOSUB may restudy in an inner call +(via a mix of recursion and enframing) something that an outer call +is in the middle of looking at. Let the outer frame deal with it. + +(CVE-2020-12723) + +(cherry picked from commit c4033e740bd18d9fbe3456a9db2ec2053cdc5271) + +port from: +https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a + +Signed-off-by: Peibao Liu +--- + embed.fnc | 2 +- + embed.h | 2 +- + proto.h | 2 +- + regcomp.c | 42 ++++++++++++++++++++++++++++++------------ + t/re/pat.t | 27 ++++++++++++++++++++++++++- + 5 files changed, 59 insertions(+), 16 deletions(-) + +diff -Naur a/embed.fnc b/embed.fnc +--- a/embed.fnc 2020-07-14 15:18:38.077000000 -0400 ++++ b/embed.fnc 2020-07-14 15:21:38.116000000 -0400 +@@ -2475,7 +2475,7 @@ + |NULLOK struct scan_data_t *data \ + |I32 stopparen|U32 recursed_depth \ + |NULLOK regnode_ssc *and_withp \ +- |U32 flags|U32 depth ++ |U32 flags|U32 depth|bool was_mutate_ok + Es |void |rck_elide_nothing|NN regnode *node + EsR |SV * |get_ANYOFM_contents|NN const regnode * n + EsRn |U32 |add_data |NN RExC_state_t* const pRExC_state \ +diff -Naur a/embed.h b/embed.h +--- a/embed.h 2020-07-14 15:18:38.095000000 -0400 ++++ b/embed.h 2020-07-14 15:21:58.416000000 -0400 +@@ -1232,7 +1232,7 @@ + #define ssc_is_cp_posixl_init S_ssc_is_cp_posixl_init + #define ssc_or(a,b,c) S_ssc_or(aTHX_ a,b,c) + #define ssc_union(a,b,c) S_ssc_union(aTHX_ a,b,c) +-#define study_chunk(a,b,c,d,e,f,g,h,i,j,k) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k) ++#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l) + # endif + # if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C) + #define _invlist_dump(a,b,c,d) Perl__invlist_dump(aTHX_ a,b,c,d) +diff -Naur a/proto.h b/proto.h +--- a/proto.h 2020-07-14 15:18:38.074000000 -0400 ++++ b/proto.h 2020-07-14 15:22:41.447000000 -0400 +@@ -5593,7 +5593,7 @@ + #define PERL_ARGS_ASSERT_SSC_UNION \ + assert(ssc); assert(invlist) + #endif +-STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth); ++STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth, bool was_mutate_ok); + #define PERL_ARGS_ASSERT_STUDY_CHUNK \ + assert(pRExC_state); assert(scanp); assert(minlenp); assert(deltap); assert(last) + #endif +diff -Naur a/regcomp.c b/regcomp.c +--- a/regcomp.c 2020-07-14 15:18:38.091000000 -0400 ++++ b/regcomp.c 2020-07-14 15:34:01.739000000 -0400 +@@ -110,6 +110,7 @@ + regnode *next_regnode; /* next node to process when last is reached */ + U32 prev_recursed_depth; + I32 stopparen; /* what stopparen do we use */ ++ bool in_gosub; /* this or an outer frame is for GOSUB */ + + struct scan_frame *this_prev_frame; /* this previous frame */ + struct scan_frame *prev_frame; /* previous frame */ +@@ -4225,7 +4226,7 @@ + I32 stopparen, + U32 recursed_depth, + regnode_ssc *and_withp, +- U32 flags, U32 depth) ++ U32 flags, U32 depth, bool was_mutate_ok) + /* scanp: Start here (read-write). */ + /* deltap: Write maxlen-minlen here. */ + /* last: Stop before this one. */ +@@ -4303,6 +4304,10 @@ + node length to get a real minimum (because + the folded version may be shorter) */ + bool unfolded_multi_char = FALSE; ++ /* avoid mutating ops if we are anywhere within the recursed or ++ * enframed handling for a GOSUB: the outermost level will handle it. ++ */ ++ bool mutate_ok = was_mutate_ok && !(frame && frame->in_gosub); + /* Peephole optimizer: */ + DEBUG_STUDYDATA("Peep", data, depth, is_inf); + DEBUG_PEEP("Peep", scan, depth, flags); +@@ -4313,7 +4318,8 @@ + * parsing code, as each (?:..) is handled by a different invocation of + * reg() -- Yves + */ +- JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); ++ if (mutate_ok) ++ JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0); + + /* Follow the next-chain of the current node and optimize + away all the NOTHINGs from it. +@@ -4345,7 +4351,7 @@ + /* DEFINEP study_chunk() recursion */ + (void)study_chunk(pRExC_state, &scan, &minlen, + &deltanext, next, &data_fake, stopparen, +- recursed_depth, NULL, f, depth+1); ++ recursed_depth, NULL, f, depth+1, mutate_ok); + + scan = next; + } else +@@ -4413,7 +4419,8 @@ + /* recurse study_chunk() for each BRANCH in an alternation */ + minnext = study_chunk(pRExC_state, &scan, minlenp, + &deltanext, next, &data_fake, stopparen, +- recursed_depth, NULL, f,depth+1); ++ recursed_depth, NULL, f, depth+1, ++ mutate_ok); + + if (min1 > minnext) + min1 = minnext; +@@ -4480,9 +4487,10 @@ + } + } + +- if (PERL_ENABLE_TRIE_OPTIMISATION && +- OP( startbranch ) == BRANCH ) +- { ++ if (PERL_ENABLE_TRIE_OPTIMISATION ++ && OP(startbranch) == BRANCH ++ && mutate_ok ++ ) { + /* demq. + + Assuming this was/is a branch we are dealing with: 'scan' +@@ -4933,6 +4941,9 @@ + newframe->stopparen = stopparen; + newframe->prev_recursed_depth = recursed_depth; + newframe->this_prev_frame= frame; ++ newframe->in_gosub = ( ++ (frame && frame->in_gosub) || OP(scan) == GOSUB ++ ); + + DEBUG_STUDYDATA("frame-new", data, depth, is_inf); + DEBUG_PEEP("fnew", scan, depth, flags); +@@ -5153,7 +5164,7 @@ + (mincount == 0 + ? (f & ~SCF_DO_SUBSTR) + : f) +- ,depth+1); ++ , depth+1, mutate_ok); + + if (flags & SCF_DO_STCLASS) + data->start_class = oclass; +@@ -5221,7 +5232,9 @@ + if ( OP(oscan) == CURLYX && data + && data->flags & SF_IN_PAR + && !(data->flags & SF_HAS_EVAL) +- && !deltanext && minnext == 1 ) { ++ && !deltanext && minnext == 1 ++ && mutate_ok ++ ) { + /* Try to optimize to CURLYN. */ + regnode *nxt = NEXTOPER(oscan) + EXTRA_STEP_2ARGS; + regnode * const nxt1 = nxt; +@@ -5267,10 +5280,10 @@ + && !(data->flags & SF_HAS_EVAL) + && !deltanext /* atom is fixed width */ + && minnext != 0 /* CURLYM can't handle zero width */ +- + /* Nor characters whose fold at run-time may be + * multi-character */ + && ! (RExC_seen & REG_UNFOLDED_MULTI_SEEN) ++ && mutate_ok + ) { + /* XXXX How to optimize if data == 0? */ + /* Optimize to a simpler form. */ +@@ -5318,7 +5331,8 @@ + /* Optimize again: */ + /* recurse study_chunk() on optimised CURLYX => CURLYM */ + study_chunk(pRExC_state, &nxt1, minlenp, &deltanext, nxt, +- NULL, stopparen, recursed_depth, NULL, 0,depth+1); ++ NULL, stopparen, recursed_depth, NULL, 0, ++ depth+1, mutate_ok); + } + else + oscan->flags = 0; +@@ -5735,7 +5749,8 @@ + /* recurse study_chunk() for lookahead body */ + minnext = study_chunk(pRExC_state, &nscan, minlenp, &deltanext, + last, &data_fake, stopparen, +- recursed_depth, NULL, f, depth+1); ++ recursed_depth, NULL, f, depth+1, ++ mutate_ok); + if (scan->flags) { + if (deltanext) { + FAIL("Variable length lookbehind not implemented"); +@@ -5827,7 +5842,7 @@ + *minnextp = study_chunk(pRExC_state, &nscan, minnextp, + &deltanext, last, &data_fake, + stopparen, recursed_depth, NULL, +- f,depth+1); ++ f, depth+1, mutate_ok); + if (scan->flags) { + if (deltanext) { + FAIL("Variable length lookbehind not implemented"); +@@ -5988,7 +6003,8 @@ + /* optimise study_chunk() for TRIE */ + minnext = study_chunk(pRExC_state, &scan, minlenp, + &deltanext, (regnode *)nextbranch, &data_fake, +- stopparen, recursed_depth, NULL, f,depth+1); ++ stopparen, recursed_depth, NULL, f, depth+1, ++ mutate_ok); + } + if (nextbranch && PL_regkind[OP(nextbranch)]==BRANCH) + nextbranch= regnext((regnode*)nextbranch); +@@ -7673,7 +7689,7 @@ + &data, -1, 0, NULL, + SCF_DO_SUBSTR | SCF_WHILEM_VISITED_POS | stclass_flag + | (restudied ? SCF_TRIE_DOING_RESTUDY : 0), +- 0); ++ 0, TRUE); + + + CHECK_RESTUDY_GOTO_butfirst(LEAVE_with_name("study_chunk")); +@@ -7802,7 +7818,7 @@ + SCF_DO_STCLASS_AND|SCF_WHILEM_VISITED_POS|(restudied + ? SCF_TRIE_DOING_RESTUDY + : 0), +- 0); ++ 0, TRUE); + + CHECK_RESTUDY_GOTO_butfirst(NOOP); + +diff -Naur a/t/re/pat.t b/t/re/pat.t +--- a/t/re/pat.t 2020-07-14 15:18:37.898000000 -0400 ++++ b/t/re/pat.t 2020-07-14 15:40:01.252000000 -0400 +@@ -23,7 +23,7 @@ + skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader; + skip_all_without_unicode_tables(); + +-plan tests => 848; # Update this when adding/deleting tests. ++plan tests => 852; # Update this when adding/deleting tests. + + run_tests() unless caller; + +@@ -1948,6 +1948,30 @@ + fresh_perl_is('m m0*0+\Rm', "",{},"Undefined behavior in address sanitizer"); + } + ++ # gh16947: test regexp corruption (GOSUB) ++ { ++ fresh_perl_is(q{ ++ 'xy' =~ /x(?0)|x(?|y|y)/ && print 'ok' ++ }, 'ok', {}, 'gh16947: test regexp corruption (GOSUB)'); ++ } ++ # gh16947: test fix doesn't break SUSPEND ++ { ++ fresh_perl_is(q{ 'sx' =~ m{ss++}i; print 'ok' }, ++ 'ok', {}, "gh16947: test fix doesn't break SUSPEND"); ++ } ++ ++ # gh17743: more regexp corruption via GOSUB ++ { ++ fresh_perl_is(q{ ++ "0" =~ /((0(?0)|000(?|0000|0000)(?0))|)/; print "ok" ++ }, 'ok', {}, 'gh17743: test regexp corruption (1)'); ++ ++ fresh_perl_is(q{ ++ "000000000000" =~ /(0(())(0((?0)())|000(?|\x{ef}\x{bf}\x{bd}|\x{ef}\x{bf}\x{bd}))|)/; ++ print "ok" ++ }, 'ok', {}, 'gh17743: test regexp corruption (2)'); ++ } ++ + } # End of sub run_tests + + 1; diff --git a/perl.spec b/perl.spec index a66a00f2db756da7fb99f26492de7f445b546e26..b99a991a25eebf364200286d9e98967f81cf6881 100644 --- a/perl.spec +++ b/perl.spec @@ -18,7 +18,7 @@ Name: perl License: (GPL+ or Artistic) and (GPLv2+ or Artistic) and MIT and UCD and Public Domain and BSD Epoch: 4 Version: 5.28.0 -Release: 434 +Release: 435 Summary: A highly capable, feature-rich programming language Url: https://www.perl.org/ Source0: https://www.cpan.org/src/5.0/%{name}-%{version}.tar.xz @@ -67,6 +67,9 @@ Patch27: Fix-time-local-tests-in-2020.patch Patch6000: CVE-2018-18312-1.patch Patch6001: CVE-2018-18312-2.patch Patch6002: CVE-2018-18312-3.patch +Patch6003: backport-CVE-2020-10543.patch +Patch6004: backport-CVE-2020-10878.patch +Patch6005: backport-CVE-2020-12723.patch BuildRequires: gcc bash findutils coreutils make tar procps bzip2-devel gdbm-devel BuildRequires: zlib-devel systemtap-sdt-devel perl-interpreter perl-generators gdb @@ -511,6 +514,12 @@ make test_harness %{_mandir}/man3/* %changelog +* Mon Aug 3 2020 wenzhanli - 4:5.28.0-435 +- Type:bugfix +- ID:NA +- SUG:NA +- DESC:CVE-2020-10543 CVE-2020-10878 CVE-12723 + * Sat Mar 21 2020 openEuler Buildteam - 4:5.28.0-434 - Type:NA - ID:NA