Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package perl-MIME-tools for openSUSE:Factory
checked in at 2026-10-29 20:05:15
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/perl-MIME-tools (Old)
and /work/SRC/openSUSE:Factory/.perl-MIME-tools.new.1255 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "perl-MIME-tools"
Thu Oct 29 20:05:15 2026 rev:43 rq:1393667 version:5.522.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/perl-MIME-tools/perl-MIME-tools.changes
2026-09-08 17:01:40.145877049 +0200
+++
/work/SRC/openSUSE:Factory/.perl-MIME-tools.new.1255/perl-MIME-tools.changes
2026-10-29 20:05:36.516389321 +0100
@@ -1,0 +2,85 @@
+Wed Oct 28 11:23:13 UTC 2026 - Tina Müller <[email protected]>
+
+- updated to 5.522.0 (5.522)
+ see /usr/share/doc/packages/perl-MIME-tools/ChangeLog
+
+ 5.522 2026-10-27 Dianne Skoll <[email protected]>
+ * VERSION 5.522 RELEASED
+ * Many security issues were addressed (see the following ten CVEs)
+ Issues were brought to my attention, and patches supplied, by the
+ CPANSec security group.
+ * parse_params: flag a parameter list that could not be parsed
+ Detect additional ambiguous parse situations when parameter
+ names contain illegal characters. Fixes:
+ CVE-2026-116264 invalid parameter hides boundary/filename. bsc#1288723
+ * parse_params: check the boundary after RFC 2231 reassembly
+ Another ambiguous-parse case was missed (trailing space after
+ boundary was not detected for RFC-2231-encoded boundaries.) Fixes:
+ CVE-2026-116265 RFC 2231 boundary skips ambiguity checks. bsc#1288722
+ * parse_params: Stricter checking for encoded boundaries; earlier
+ versions would miss some cases. Fixes:
+ CVE-2026-116266 boundary changed by decoding not flagged. bsc#1288721
+ * Cap the indentation levels in the Results: structure. Otherwise,
+ specially-crafted messages could consume large amounts of memory.
+ Fixes: CVE-2026-116267 indent stored per message per level bsc#1288720
+ * parse_params: stop a comment match at the next parenthesis.
+ Otherwise, specially-crafted messages could cause the regex
+ back-tracker to consume large amounts of CPU time. Note that
+ MIME::Parser does not correctly parse ((nested comments)) and
+ has never done so. Fixes:
+ CVE-2026-116268 unclosed "(" comments backtrack CPU exhaustion.
bsc#1288719
+ * parse_params: re-encode filename* values without charset tricks
+ Specially-crafted messages could trick recommended_filename()
+ into returning an empty string instead of a plausible filename.
+ Fixes: CVE-2026-116269 RFC 2231 language tag empties filename.
bsc#1288718
+ * decode_mimewords: do not copy the input into each error. Otherwise,
+ specially-crafted messages could consume large amounts of memory.
+ Fixes: CVE-2026-116270 each bad "=?" copies the input into $@.
bsc#1288717
+ * FileUnder: do not reuse an existing generated directory. Otherwise,
+ attackers might be able to use symbolic links to get files created
+ in unexpected locations. Fixes:
+ CVE-2026-116271 FileUnder reuses a pre-created directory. bsc#1288716
+ * parse_params: flag comments other readers do not skip
+ Specially-crafted messages could create ambiguous messages without
+ setting the ambiguous_parse flag. Fixes:
+ CVE-2026-116272 comment hides a duplicate boundary. bsc#1288715
+ * Call whine() rather than error() if max_parts or max_depth is
+ exceeded during a parse. This lets us return undef rather than
+ throwing an exception if ignore_errors() is set to 0.
+ * Change to defaults: max_parts is now set to 1000 and max_depth
+ to 64 rather than being unlimited. This should not affect most
+ real-world uses of MIME::tools, but you may need to increase
+ these values or set them to -1 (unlimited) if you run into trouble.
+ ***** NOTE INCOMPATIBILITY *****
+ Fixes: CVE-2026-116273 max_parts and max_depth unlimited. bsc#1288714
+ * Do not signal an ambiguous parse if we have filename="" or
+ name=""
+ * Update author names in META.yml
+ * Add git repo to META.yml
+ 5.520 2026-10-21 Dianne Skoll <[email protected]>
+ * VERSION 5.520 RELEASED
+ * MIME::Parser used O(N^2) CPU time and memory parsing a MIME
+ message nested N levels deep. A smallish specially-crafted
+ message could DOS the computer by making it consume enormous
+ amounts of memory and CPU time. The parser was modified to use
+ O(N) time and memory in this case. Additionally, a new
+ MIME::Parser::max_depth() function was added to limit the nesting
+ depth before declaring a parse failure. Problem was reported to
+ me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.
+ * MIME::Parser would ignore multiple blank lines in a message
+ preamble when parsing it; this could break DKIM. Problem pointed
+ out and fix suggested by Tim Henderson.
+ * If a MIME boundary includes trailing whitespace, we mark the
+ parse as ambiguous. Problem noted and patch submitted by
+ Christian Herdtweck
+ 5.519 2026-09-22 Dianne Skoll <[email protected]>
+ * VERSION 5.519 RELEASED
+ * Some (buggy) software creates base64-encoded parts as a
+ concatenation of multiple base64-encoded streams, and some client
+ software decodes each stream separately and concatenates the
+ results. Duplicate this behavior in MIME::tools to prevent it
+ from being used as a mechanism to sneak dangerous content past a
+ security scanner. Patch courtesy of Giorgio Premi
+ <[email protected]>.
+
+-------------------------------------------------------------------
Old:
----
MIME-tools-5.518.tar.gz
New:
----
MIME-tools-5.522.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ perl-MIME-tools.spec ++++++
--- /var/tmp/diff_new_pack.vCqyy1/_old 2026-10-29 20:05:39.086497044 +0100
+++ /var/tmp/diff_new_pack.vCqyy1/_new 2026-10-29 20:05:39.088497127 +0100
@@ -18,10 +18,10 @@
%define cpan_name MIME-tools
Name: perl-MIME-tools
-Version: 5.518.0
+Version: 5.522.0
Release: 0
-# 5.518 -> normalize -> 5.518.0
-%define cpan_version 5.518
+# 5.522 -> normalize -> 5.522.0
+%define cpan_version 5.522
License: Artistic-1.0 OR GPL-1.0-or-later
Summary: Tools to manipulate MIME messages
URL: https://metacpan.org/release/%{cpan_name}
++++++ MIME-tools-5.518.tar.gz -> MIME-tools-5.522.tar.gz ++++++
++++ 3754 lines of diff (skipped)
++++++ _scmsync.obsinfo ++++++
--- /var/tmp/diff_new_pack.vCqyy1/_old 2026-10-29 20:05:39.861529528 +0100
+++ /var/tmp/diff_new_pack.vCqyy1/_new 2026-10-29 20:05:39.879530283 +0100
@@ -1,6 +1,6 @@
-mtime: 1787848486
-commit: 034418b05d900282925cb365c8fe30849b46fb7f8575507457ad261129549567
+mtime: 1793291129
+commit: 545f2df80e27d6072e4d1d4179751746f410dca7edbfc878cc4f4f69f3ef315e
url: https://src.opensuse.org/perl/perl-MIME-tools
-revision: 034418b05d900282925cb365c8fe30849b46fb7f8575507457ad261129549567
+revision: 545f2df80e27d6072e4d1d4179751746f410dca7edbfc878cc4f4f69f3ef315e
projectscmsync: https://src.opensuse.org/perl/_ObsPrj
++++++ build.specials.obscpio ++++++
++++++ build.specials.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/.gitignore new/.gitignore
--- old/.gitignore 1970-01-01 01:00:00.000000000 +0100
+++ new/.gitignore 2026-10-29 17:25:29.000000000 +0100
@@ -0,0 +1 @@
+.osc
