nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-08-25 17:55:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

perlPackages.DateManip: fix CVE-2026-60074 and CVE-2026-60075

Browse Source 
Apply CPAN Security's complete fixes for rejecting non-ASCII numeric
date fields and bounding parser input before expensive regular
expressions run.

Move the existing date fallback substitution to postPatch so the
standard patch phase applies the security patches first.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 7e09d3726c)
This commit is contained in:
Gerhard Schwanzer
2026-08-02 14:43:29 +02:00
committed by github-actions[bot]
parent af1d4254a9
commit e63e3c448f
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
pkgs/top-level/perl-packages.nix
View File

@@ -8914,8 +8914,21 @@ with self;
url = "mirror://cpan/authors/id/S/SB/SBECK/Date-Manip-6.98.tar.gz";
hash = "sha256-rP2KYFGbpM0YHIpnqD1/ApxtmrTosCEtxH5B1iEP2kk=";
};
# Remove when updating to the first release containing both CVE fixes.
patches = [
(fetchpatch {
name = "CVE-2026-60074.patch";
url = "https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch";
hash = "sha256-leXFfzLyy0yBpBXgT3u3ZyFaIbsbJSFzVkdam9hb3+0=";
})
(fetchpatch {
name = "CVE-2026-60075.patch";
url = "https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch";
hash = "sha256-vMsOrUhrfn8efKRzfJ+jaypOHER8MlUIob5u88n/TAw=";
})
];
# for some reason, parsing /etc/localtime does not work anymore - make sure that the fallback "/bin/date +%Z" will work
patchPhase = ''
postPatch = ''
sed -i "s#/bin/date#${pkgs.coreutils}/bin/date#" lib/Date/Manip/TZ.pm
'';
doCheck = !stdenv.hostPlatform.isi686; # build freezes during tests on i686