Fedora alert FEDORA-2026-8cec3cbf5b (perl-HTTP-Date)

From:
             
 
updates--- via package-announce <package-announce@lists.fedoraproject.org>
To:
             
 
package-announce@lists.fedoraproject.org
Subject:
             
 
[SECURITY] Fedora 44 Update: perl-HTTP-Date-6.08-1.fc44
Date:
             
 
Fri, 17 Jul 2026 00:54:22 +0000
Message-ID:
             
 
<20260717005422.463AF7656A@bastion01.rdu3.fedoraproject.org>
Archive-link:
             
 
Article
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-8cec3cbf5b
2026-07-17 00:51:59.635497+00:00
--------------------------------------------------------------------------------

Name        : perl-HTTP-Date
Product     : Fedora 44
Version     : 6.08
Release     : 1.fc44
URL         : https://metacpan.org/release/HTTP-Date
Summary     : Date conversion routines
Description :
This module provides functions that deal the date formats used by the HTTP
protocol (and then some more). Only the first two functions, time2str() and
str2time(), are exported by default.

--------------------------------------------------------------------------------
Update Information:

Changes:
6.08      2026-07-09 02:04:21Z
- [SECURITY] Reject input longer than 64 characters in parse_date()
  to prevent quadratic regex backtracking (a denial of service) on
  hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)
6.07      2026-06-25 15:12:09Z
- Add test with Time::Zone (GH#25) (Michal Josef Špaček)
- Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček)
- Add tests with negative time (GH#26) (Michal Josef Špaček)
- Replace all instances of \d with [0-9] in regular expressions to
  reject non-ASCII Unicode digits, with a regression test (GH#27)
  (Robert Rothenberg)
- Reject malformed ISO 8601 timezones with a doubled colon (GH#31)
  (Olaf Alders)
- Document day/month/year ordering for numeric dates (GH#32) (Olaf
  Alders)
--------------------------------------------------------------------------------
ChangeLog:

* Mon Jul 13 2026 Michal Josef Špaček <mspacek@redhat.com> - 6.08-1
- 6.08 bump
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2492991 - perl-HTTP-Date-6.08 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2492991
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-8cec3cbf5b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgr...

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------



Attachment: None (type=text/plain)
-- 
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond...
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/package-ann...
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new