Your message dated Sun, 16 Aug 2026 16:33:54 +0000
with message-id <[email protected]>
and subject line Bug#1144539: fixed in libnet-oauth-perl 0.32-1
has caused the Debian Bug report #1144539,
regarding libnet-oauth-perl: CVE-2026-72887 CVE-2026-72888
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1144539: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144539
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libnet-oauth-perl
Version: 0.31-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for libnet-oauth-perl.
CVE-2026-72887[0]:
| Net::OAuth::Client versions before 0.32 for Perl allow the service
| provider to silently downgrade OAuth 1.0a to OAuth 1.0 in
| get_request_token. Passing a callback to the constructor selects
| OAuth 1.0a. get_request_token then revokes that choice when the
| request token response omits oauth_callback_confirmed, with no
| exception, no warning and no option to require 1.0a. The access
| token request is built from the OAuth 1.0 message class, which has
| no verifier parameter, so oauth_verifier is dropped from the request
| even when get_access_token was passed one. oauth_verifier is the
| binding that OAuth 1.0a added between the authorization step and the
| token exchange. An application that asked for 1.0a and gets 1.0 is
| open to OAuth 1.0 session fixation, where an attacker obtains a
| request token, has the victim authorize it, and then completes the
| exchange themselves, linking the victim's provider account to a
| session the attacker controls. No attacker action sets up the
| downgrade: a provider that does not confirm the callback is enough.
CVE-2026-72888[1]:
| Net::OAuth versions before 0.32 for Perl allow memory exhaustion via
| unbounded caching of failed module loads in smart_require.
| smart_require stores results in a process-global hash with no bound
| and no eviction, and keeps an entry for every class name it is asked
| about, including names that failed to load, because the return value
| of the failed eval is stored before the error is checked. The key
| comes off the wire on the server side: _signature_method_class
| builds the class name from the signature_method parameter of the
| incoming message, and verify resolves it before any signature is
| checked. A remote client chooses both how many entries are created
| and how long each key is. In a persistent server the hash grows for
| the life of the worker process until it exhausts memory. Header size
| limits bound the key length on the Authorization header path, but
| not on a POST body.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-72887
https://www.cve.org/CVERecord?id=CVE-2026-72887
[1] https://security-tracker.debian.org/tracker/CVE-2026-72888
https://www.cve.org/CVERecord?id=CVE-2026-72888
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libnet-oauth-perl
Source-Version: 0.32-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libnet-oauth-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated libnet-oauth-perl
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 16 Aug 2026 17:54:05 +0200
Source: libnet-oauth-perl
Architecture: source
Version: 0.32-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1144539
Changes:
libnet-oauth-perl (0.32-1) unstable; urgency=medium
.
* Import upstream version 0.32.
- Net::OAuth::Client no longer allows silent downgrades from
OAuth 1.0a to 1.0 when the remote provider drops the
oauth_verifier. The behavior can be re-enabled with the
allow_v1a_downgrade option. CVE-2026-72887
- The Net::OAuth smart_require function no longer memoizes
failures, which allowed attackers to exhaust memory with
requests for invalid signature methods. CVE-2026-72888
(Closes: #1144539)
* Update upstream email addresses.
* The upstream examples are gone.
* Install new CONTRIBUTING.md file.
* Drop 0001-Pin-PKCS-1-v1.5-padding-and-SHA-1-for-RSA-SHA1-signa.patch
which was taken from upstream Git.
* Update dependencies.
Checksums-Sha1:
ed259c19131920ffde84542d82b1cfe40666d50c 2646 libnet-oauth-perl_0.32-1.dsc
4c8cfa90d058f0ce99ac4bdc20882eb319bea9eb 32274
libnet-oauth-perl_0.32.orig.tar.gz
7d8c5154f7a30505fe555bf9721e54a31da3fea5 4428
libnet-oauth-perl_0.32-1.debian.tar.xz
0ecc7a5044b660b2051408cd5a9876a2c3ef1650 106176
libnet-oauth-perl_0.32-1.git.tar.xz
070168cba2128976ad29beed8a2a60084dd2d9a7 17588
libnet-oauth-perl_0.32-1_source.buildinfo
Checksums-Sha256:
3d45f2a2ffcc3f8c02c0ab25178a390a7653897e8ec8c78478c8d6e78b673fd1 2646
libnet-oauth-perl_0.32-1.dsc
163180cf34b03bba31372d5f4cae24d382c41ab828abf34cafad7d9b5727a74a 32274
libnet-oauth-perl_0.32.orig.tar.gz
b39719e9e76a0e6fc87adfd889b8315847c0f7d8ee3ca8182aeb6fe07c5009f8 4428
libnet-oauth-perl_0.32-1.debian.tar.xz
4c77f2ba87162bfd79ce1d6d675ee3945c8762c513e22460084660cd62c2011a 106176
libnet-oauth-perl_0.32-1.git.tar.xz
76d3712cef45e488913cca564344e5a0265f3348623cc92da1be42eeb9803c1d 17588
libnet-oauth-perl_0.32-1_source.buildinfo
Files:
2ecd9eb3a191c71c5e4a319b30abd05b 2646 perl optional
libnet-oauth-perl_0.32-1.dsc
be08a8e9a6ac5c86d0c9cd521980d07d 32274 perl optional
libnet-oauth-perl_0.32.orig.tar.gz
1b9c1a8af5a643a4d5b7e26ec21b6094 4428 perl optional
libnet-oauth-perl_0.32-1.debian.tar.xz
13547fe2bed1eafe2cbec1481ff2c032 106176 perl None
libnet-oauth-perl_0.32-1.git.tar.xz
c7f553c36af8118fc95ba934a8258c76 17588 perl optional
libnet-oauth-perl_0.32-1_source.buildinfo
Git-Tag-Info: tag=e7955ba346336f104f53741bf939df2a18539fd6
fp=d1e1316e93a760a8104d85fabb3a68018649aa06
Git-Tag-Tagger: gregor herrmann <[email protected]>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqB3jgACgkQYG0ITkaD
wHkcDQ//b6Lz6WWz7dAbih9cUodYRoymttt8GiS+0K6mPepJM8tsHTRhsX+DdC57
QOFTFg2HlgR/xraIhSSJiZr3tqQmojJ3CO78xU2mcFztATtTeQZaWKFCzhvKpg9k
zxnoNXOlTp8o//gYodubtXAZ+FQhR5LstPF+ZVkSJlE1y3ViswEzeid6ZfTlXRzH
VD8kqp9659E7Uxc1kJr73qys9cHYF86Ix38H75MzFRaowz273+L7dYMyitVVnTCm
EEIQ/5Pxwf9jqUCYWbyuy0V6fSc0abUh49Qp4AO4+hNTnReMCd+QnI406233lTVD
nh5IRDmnu41zcgt3dLvRPxrPlwC65R4zOj9iSmwPfI9QKYXb3YQR7WnWCXVXMQ1X
QEpRCQQPhY+U0lo6zRv+r2BueArmbD4dAywhbaPlSkdwpNERYRg6BwrJIaTZ/Ogd
mOjzeRKghHwVCZG4yO5JEQ/EhA4iv8BXpPxZTn2Xm7uwCsjAHaJI2OeFiszSt7Bi
eRvKwdTXddmYQDRlnealzzaJ+3B2rgDNAuI1isDUcCRLSBk6TUzVFB2glySW2Uzz
ZaIHaIYEOk+TsgKoy5HH8tMxyfZf143pGa2idoHkXQH7Ec4gkBBP9XDiIW0n9OQA
jZci/KUenJ0wPcyQkCwS7t7K3hbVJTVlD8fo/PEfwsNpmFiihLM=
=MTBO
-----END PGP SIGNATURE-----
pgpi04cSwUjKy.pgp
Description: PGP signature
--- End Message ---
