Fedora alert FEDORA-2026-c8484f1afb (perl-YAML-Syck)
| From: | updates--- via package-announce <package-announce@lists.fedoraproject.org> | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 43 Update: perl-YAML-Syck-1.47-1.fc43 | |
| Date: | Thu, 23 Jul 2026 01:04:12 +0000 | |
| Message-ID: | <20260723010412.6DF18764D7@bastion01.rdu3.fedoraproject.org> | |
| Archive-link: | Article |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2026-c8484f1afb 2026-07-23 01:01:59.493878+00:00 -------------------------------------------------------------------------------- Name : perl-YAML-Syck Product : Fedora 43 Version : 1.47 Release : 1.fc43 URL : https://metacpan.org/release/YAML-Syck Summary : Fast, lightweight YAML loader and dumper Description : This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around. -------------------------------------------------------------------------------- Update Information: This update addresses four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags: CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input There are also a few other bug-fixes included. -------------------------------------------------------------------------------- ChangeLog: * Tue Jul 14 2026 Paul Howarth <paul@city-fan.org> - 1.47-1 - Update to 1.47 Security: - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load() path on untrusted input with no special flags (GH#213) - CVE-2026-57075 (CWE-125): Out-of-bounds read in the base64 decoder caused by signed-char indexing of the decode table on !!binary input - CVE-2026-57076 (CWE-416): Use-after-free of an anchor key string shared between the node and the anchors table - CVE-2026-57077 (CWE-125): One-byte out-of-bounds read in the lexer newline scan during block-scalar parsing (incomplete-fix follow-on to CVE-2025-11683) - CVE-2026-13713 (CWE-416/CWE-415): Use-after-free / double-free of an anchor node on anchor redefinition, a remote-crash DoS from a 7-byte input - Harden syck_base64dec() to bounds-check each read so it cannot run past a non-NUL-terminated input buffer (defense-in-depth for callers passing raw buffers; GH#213) Bug Fixes: - Fix: Enforce $MaxDepth on Load to prevent C-stack exhaustion from deeply nested YAML/JSON input; YAML::Syck and JSON::Syck Load now default to 512, matching Dump (GH#204) - Fix: Emit YAML canonical forms (.nan, .inf, -.inf) for NaN/Inf values in Dump so they roundtrip with ImplicitTyping instead of reloading as plain strings (GH#201) Maintenance: - CI: add an AddressSanitizer job that builds the XS with -fsanitize=address and runs the suite plus the CVE trigger inputs to catch libsyck memory-safety defects; de-pin the libasan version so it tracks the runner's GCC (GH#213) * Mon May 25 2026 Paul Howarth <paul@city-fan.org> - 1.46-1 - Update to 1.46 Bug Fixes: - Preserve string nature of numeric-looking values in Dump; pure strings (POK only, no IOK/NOK) are now quoted to maintain roundtrip fidelity (GH#199, GH#200) - Accept trailing commas in flow sequences and mappings ([a, b,] and {a: 1,}), valid per YAML 1.0/1.1/1.2 spec (GH#195, GH#196) Maintenance: - CI: upgrade install-with-cpm to v2 for compatibility with Perl versions prior to 5.24 in perldocker containers (GH#197, GH#198) - Clean up MANIFEST.SKIP: add #!include_default, remove redundant entries, exclude .claude/ from distribution -------------------------------------------------------------------------------- References: [ 1 ] Bug #2501651 - CVE-2026-57075 perl-YAML-Syck: YAML::Syck: Information disclosure via out-of-bounds read in base64 decoder [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501651 [ 2 ] Bug #2501653 - CVE-2026-57077 perl-YAML-Syck: YAML::Syck: Information disclosure via out-of-bounds read [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501653 [ 3 ] Bug #2501654 - CVE-2026-57076 perl-YAML-Syck: YAML::Syck: Heap use-after-free via anchor name reuse [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501654 [ 4 ] Bug #2501656 - CVE-2026-13713 perl-YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2501656 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-c8484f1afb' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgr... All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list -- package-announce@lists.fedoraproject.org To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond... List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/package-ann... Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new