SUSE-SU-2026:4926-1

SUSE-SU-2026:4926-1 · Security update for perl-Cpanel-JSON-XS

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

This update for perl-Cpanel-JSON-XS fixes the following issues: - CVE-2025-40929: integer overflow (bsc#1249331). - CVE-2026-9334: type confusion via duplicate object keys when `dupkeys_as_arrayref` is enabled (bsc#1267546). - CVE-2026-9516: denial of service via UTF-8 BOM prefixed input when a decode filter callback throws (bsc#1267547). - CVE-2026-110672: leak of decoded key of an object rejected for a duplicate key or a missing colon in `decode_hv` (bsc#1286166). - CVE-2026-110673: stack exhaustion via nested tagged values under `allow_tags` in `decode_tag` (bsc#1286167). - CVE-2026-110674: duplicate non-ASCII bare keys are missed, allowing type confusion under `dupkeys_as_arrayref` in `decode_hv` (bsc#1286168). - CVE-2026-110675: malformed UTF-8 accepted in bare hash keys under `allow_barekey` in `decode_hv` (bsc#1286169). - CVE-2026-110676: memory exhaustion by encoding exponent notation as full decimal digits under `allow_bignum` (bsc#1286170). - CVE-2026-110677: array collecting duplicate key values leaked under `dupkeys_as_arrayref` in `decode_hv` (bsc#1286173). - CVE-2026-110678: memory exhaustion by buffering incremental input past `max_size` in `incr_parse` (bsc#1286174). - CVE-2026-110680: out-of-bounds write when a tied or shared hash grows during canonical encoding in `encode_hv` (bsc#1286175). - CVE-2026-110681: parent interpreter's scalars from a parser object cloned into a new `ithread` (bsc#1286176). - CVE-2026-110682: input chunking can change the decoded value of top-level numbers in `incr_parse` (bsc#1286177). - CVE-2026-110684: memory leaked and overloaded objects retained when encoding values as strings in `encode_stringify` (bsc#1286179). - CVE-2026-110685: decoded arguments of a tagged value leaked when its THAW method dies in `decode_tag` (bsc#1286180). - CVE-2026-110686: freed filter callbacks used when a filter removes itself during decoding in `decode_hv` (bsc#1286181). - CVE-2026-110687: byte-string keys misordered during canonical encoding in `utf16_cmp` (bsc#1286182). - CVE-2026-110688: quadratic CPU use due to remaining buffer revalidation per value in `incr_parse` (bsc#1286183). Changes for perl-Cpanel-JSON-XS: - updated to 4.800.0 (4.80) - Add version markers to all module files. (PR #260 demerphq) - Use utf8n_to_uvchr on Perl 5.32 and later to avoid the deprecated utf8n_to_uvuni API. (PR #260 demerphq) - Add schema-based validation for decoded JSON (GH #238): Cpanel::JSON::XS::Type now provides check_type($data, $schema[, $found_type]), which validates an already-decoded perl structure against a type spec built from the existing encoder building blocks (JSON_TYPE_* / json_type_arrayof / json_type_hashof / json_type_anyof), plus the new json_type_optional() for hash keys that may be absent, and short scalar type name sugar ('Str', 'Int', 'Float', 'Bool', 'Null', 'Any', and nullable 'Str?' etc.) so a schema reads as 'just a hash of keys and types', as requested. Unlike the encoder's hash type spec, a plain hashref schema is closed: unknown keys and missing required keys are reported. New $json->decode_and_validate($json_text, $schema) method decodes and croaks with all mismatches if validation fails, using decode()'s own type introspection as ground truth to avoid perl's usual dual-var/stringified-number ambiguity. - json_type_optional() and the nullable '?' type-name suffixes ('Str?', 'Int?', 'Float?', 'Bool?') give schemas an explicit way to declare a key/value as optional instead of demanding a complete type specification for every key. The encoder now also understands json_type_optional() directly (it unwraps to the wrapped type, since encode() only ever sees keys that are actually present): the exact same type spec built for check_type()/decode_and_validate() can now be handed to encode() as-is, instead of croaking with 'no type was specified for hash key '...'' for every optional key. Encoding stays strict by default otherwise: a hash key with no entry at all in the type spec still croaks (GH #242). eg/bench_large.pl: old encode: 20.5--22.9/s decode: 16.2--16.5/s for 4.53 new encode: 21.1--22.5/s decode: 15.7--16.3/s for 4.80 4.53 2026-09-28 (rurban) - Fix C90 violations with arm neon (GH #258 rjbs) - Added a native arm64 test runner. - updated to 4.520.0 (4.52) 4.52 2026-09-12 (rurban) - OSX 10.9 fix for SIMD UTF-8 (Christian Carey) - Change my maintainer email to [email protected] 4.51 2026-09-11 (rurban) - Add faster SIMD UTF-8 validation (GH #213, Zhang Boyang) - Fix tests for yath (GH #255, with H.Merijn Brand): the test files now work with Test2::Harness instead of only Test::Harness, and a yath run is added to `make xtest` when yath is installed. - Skip one t/117_numbers.t test on Perls with 32-bit IVs (GH #254, Jeremy Hansen). 4.50 2026-09-08 (rurban) - Add $json->encode_to($fh, $data, [$type]) to stream encoded JSON directly to a filehandle instead of building the whole result in memory (GH #250, requested by yairlenga. designed 2016 in GH #58). Internally flushes a bounded 8k chunk buffer as it fills, keeping peak memory bounded for large data structures. - Encoder performance improvements suggested in GH #237 (17dec): * Large-integer encoding now uses a 100-digit lookup table instead of snprintf, roughly 2x faster for integers outside the existing branchless small-integer fast path (|value| > 59000). * encode_str now bulk-copies runs of consecutive bytes that need no escaping instead of a need()+store per byte, notably faster for strings with few or no characters to escape. Added eg/bench_large.pl with results. - updated to 4.440.0 (4.44) 4.44 2026-09-02 (rurban) - Fix canonical sort infinite loop (GH #252 amelchio): malformed UTF-8 keys (e.g. Latin-1 byte strings mixed with Unicode) made utf16_cmp treat the decoder's (STRLEN)-1 malformed sentinel as a length, wrapping the buffer pointer. Now checked as 0 or > remaining length. - updated to 4.430.0 (4.43) 4.43 2026-07-18 (rurban) - Fix canonical sort: compare by UTF-16 code units per RFC 8785 (GH #248, leont) - Fix canonical sort on Perl 5.8-5.18: utf16_cmp now always attempts UTF-8 decoding instead of checking SvUTF8 flag, since older Perls may store valid UTF-8 hash keys without the flag set. - Fix quadmath encode dropping '.0' for large floats (GH #246, reported by Tux). The .0 guard condition that suppressed appending for NV values > UV_MAX was incorrect on high-precision FP (quadmath, 128-bit long double on arm64) where %g uses fixed-point notation for values like 1.01e30. Guarded with #if NV_DIG < 31 to skip only on double/80-bit-ld where %g naturally uses %e for large values. - updated to 4.420.0 (4.42) 4.42 2026-06-27 (rurban) - Ensure encode with a type spec hashref does not change the hashref argument (GH #240) - Fix -e docs: 'written' -> 'read' (GH #239, reported by Ron Savage). - Fix Boolean eq overload matching undef (GH #207, reported by fd-t). Cpanel::JSON::XS::Boolean overloaded eq would match undef as equal to false because undef stringifies to ''. Added defined() guard. - Fix error messages showing overloaded stringification for blessed objects (GH #191, reported by karenetheridge). Error messages now use ClassName=TYPE(addr) format, bypassing any '' overload. - Fix type_all_string overriding allow_blessed/convert_blessed (GH #175, reported by alpha6). With type_all_string + allow_blessed, blessed objects are now encoded as null (not stringified as HASH address). - Fix infinite recursion when encode is called from a '' overload (GH #128, reported by pbrthemaster). The recursion guard temporarily clears convert_blessed and allow_stringify flags on the JSON object before calling the overload, preventing re-entrant encode loops. - Fix $obj->new creating a broken object (GH #93, reported by cpansprout). When new() is called on an existing object (e.g. $json->new->new), the class name is now extracted from the object's sta

Corrección disponible

Publicación

2026-10-28T16:22:21Z

Actualización

2026-10-29T19:15:04.329675904Z

Pila tecnológica: system

Comprueba tu servidor →