From 7a147d4004864f0f3cca385bdaebaaacdb53fb7a Mon Sep 17 00:00:00 2001 From: Stig Palmquist Date: Thu, 18 Jun 2026 14:04:00 +0200 Subject: [PATCH] perlPackages.CpanelJSONXS: 4.37 -> 4.42 Fixes CVE-2026-9334, CVE-2026-9516. Supersedes the in-tree CVE-2025-40929 patch. Assisted-by: Claude Code (Claude Opus 4.8) Signed-off-by: Stig Palmquist (cherry picked from commit 66e7adfa8f255bff2e1ec8c12b888a8514aad48c) --- .../Cpanel-JSON-XS-CVE-2025-40929.patch | 47 ------------------- pkgs/top-level/perl-packages.nix | 7 ++- 2 files changed, 3 insertions(+), 51 deletions(-) delete mode 100644 pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch diff --git a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch b/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch deleted file mode 100644 index 0f76f7313fde..000000000000 --- a/pkgs/development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 5592bfb58eb8d1c8a644e67c9bba795d1384a995 Mon Sep 17 00:00:00 2001 -From: Marc Lehmann -Date: Sat, 6 Sep 2025 11:31:36 +0200 -Subject: [PATCH 1/2] fix json_atof_scan1 overflows - -with fuzzed overlong numbers. CVE-2025-40928 -Really the comparisons were wrong. ---- - XS.xs | 8 ++++---- - 1 file changed, 4 insertions(+), 4 deletions(-) - -diff --git a/XS.xs b/XS.xs -index 9b1ce2b..94ab0d6 100755 ---- a/XS.xs -+++ b/XS.xs -@@ -710,16 +710,16 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth) - /* if we recurse too deep, skip all remaining digits */ - /* to avoid a stack overflow attack */ - if (UNLIKELY(--maxdepth <= 0)) -- while (((U8)*s - '0') < 10) -+ while ((U8)(*s - '0') < 10) - ++s; - - for (;;) - { -- U8 dig = (U8)*s - '0'; -+ U8 dig = (U8)(*s - '0'); - - if (UNLIKELY(dig >= 10)) - { -- if (dig == (U8)((U8)'.' - (U8)'0')) -+ if (dig == (U8)('.' - '0')) - { - ++s; - json_atof_scan1 (s, accum, expo, 1, maxdepth); -@@ -739,7 +739,7 @@ json_atof_scan1 (const char *s, NV *accum, int *expo, int postdp, int maxdepth) - else if (*s == '+') - ++s; - -- while ((dig = (U8)*s - '0') < 10) -+ while ((dig = (U8)(*s - '0')) < 10) - exp2 = exp2 * 10 + *s++ - '0'; - - *expo += neg ? -exp2 : exp2; --- -2.50.1 - diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix index 47e3e1035ddc..a112470336b0 100644 --- a/pkgs/top-level/perl-packages.nix +++ b/pkgs/top-level/perl-packages.nix @@ -6691,12 +6691,11 @@ with self; CpanelJSONXS = buildPerlPackage { pname = "Cpanel-JSON-XS"; - version = "4.37"; + version = "4.42"; src = fetchurl { - url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.37.tar.gz"; - hash = "sha256-wkFhWg4X/3Raqoa79Gam4pzSQFFeZfBqegUBe2GebUs="; + url = "mirror://cpan/authors/id/R/RU/RURBAN/Cpanel-JSON-XS-4.42.tar.gz"; + hash = "sha256-4awvqx46bS2ZjTRAxgAGc2W9x9vwyPKyBZy85LTIMXM="; }; - patches = [ ../development/perl-modules/Cpanel-JSON-XS-CVE-2025-40929.patch ]; meta = { description = "CPanel fork of JSON::XS, fast and correct serializing"; license = with lib.licenses; [