From 2e5ab1c8cc93f6461eda61b78f86917b9b164c62 Mon Sep 17 00:00:00 2001 From: Azure Linux Security Servicing Account Date: Mon, 7 Sep 2026 04:53:41 +0000 Subject: [PATCH 1/3] Patch perl-URI for CVE-2026-19953 --- SPECS/perl-URI/CVE-2026-19953.patch | 123 ++++++++++++++++++++++++++++ SPECS/perl-URI/perl-URI.spec | 7 +- 2 files changed, 129 insertions(+), 1 deletion(-) create mode 100644 SPECS/perl-URI/CVE-2026-19953.patch diff --git a/SPECS/perl-URI/CVE-2026-19953.patch b/SPECS/perl-URI/CVE-2026-19953.patch new file mode 100644 index 00000000000..e075268d699 --- /dev/null +++ b/SPECS/perl-URI/CVE-2026-19953.patch @@ -0,0 +1,123 @@ +From 471e9e657e8112491205773c55ffff77d6db4b65 Mon Sep 17 00:00:00 2001 +From: AllSpark +Date: Mon, 7 Sep 2026 04:47:41 +0000 +Subject: [PATCH] Normalize IDNA labels with NFC in nameprep [CVE-2026-19953] + +Signed-off-by: Azure Linux Security Servicing Account +Upstream-reference: AI Backport of https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch +--- + Changes | 7 +++++++ + cpanfile | 1 + + lib/URI/_idna.pm | 21 ++++++++++++++++----- + t/idna.t | 22 ++++++++++++++++++++-- + 4 files changed, 44 insertions(+), 7 deletions(-) + +diff --git a/Changes b/Changes +index 536a0ce..841bb58 100644 +--- a/Changes ++++ b/Changes +@@ -1,5 +1,12 @@ + Revision history for URI + ++{{}} ++ - Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host ++ encoding matches other clients instead of emitting a non-standard, ++ non-round-tripping A-label [CVE-2026-19953] (reported by Naseeb Dangi, ++ @naseeb0) (GH#191) ++ ++ + 5.21 2023-08-23 16:02:14Z + - Fix version declarations in icap.pm and icaps.pm (GH#131) (Olaf Alders) + +diff --git a/cpanfile b/cpanfile +index 467f4b7..8ca0da7 100644 +--- a/cpanfile ++++ b/cpanfile +@@ -31,6 +31,7 @@ on 'runtime' => sub { + requires "MIME::Base64" => "2"; + requires "Net::Domain" => "0"; + requires "Scalar::Util" => "0"; ++ requires "Unicode::Normalize" => "0"; + requires "constant" => "0"; + requires "integer" => "0"; + requires "overload" => "0"; +diff --git a/lib/URI/_idna.pm b/lib/URI/_idna.pm +index 5d4a016..ea3f802 100644 +--- a/lib/URI/_idna.pm ++++ b/lib/URI/_idna.pm +@@ -6,8 +6,9 @@ package URI::_idna; + use strict; + use warnings; + +-use URI::_punycode qw(decode_punycode encode_punycode); +-use Carp qw(croak); ++use URI::_punycode qw(decode_punycode encode_punycode); ++use Unicode::Normalize qw(NFC); ++use Carp qw(croak); + + our $VERSION = '5.21'; + +@@ -38,10 +39,20 @@ sub decode { + return join(".", map ToUnicode($_), split(/\./, $domain, -1)) + } + +-sub nameprep { # XXX real implementation missing ++sub nameprep { + my $label = shift; +- $label = lc($label); +- return $label; ++ ++ # Lowercase, then normalize. Without normalization a non-NFC label encodes ++ # to a non-standard A-label that other IDNA implementations reject, so a ++ # host used for a security check can differ from the host actually fetched. ++ # We normalize with NFC (canonical composition): RFC 3491 (IDNA2003) ++ # nominally called for NFKC, but RFC 5891 (IDNA2008) replaced that with NFC, ++ # which is also what UTS #46 applies in browsers and other clients. The ++ # prohibited-character and bidi tables that a full nameprep would enforce ++ # remain unimplemented. A host passed as bytes rather than decoded ++ # characters is treated as Latin-1 per URI's documented contract (see the ++ # host/ihost examples in URI.pm), so pass decoded characters for UTF-8. ++ return NFC(lc $label); + } + + sub check_size { +diff --git a/t/idna.t b/t/idna.t +index 37434b0..8dbde2a 100644 +--- a/t/idna.t ++++ b/t/idna.t +@@ -2,8 +2,9 @@ use strict; + use warnings; + + use utf8; +-use Test::More tests => 7; +-use URI::_idna (); ++use Test::More; ++use Test::Fatal qw( exception ); ++use URI::_idna (); + + is URI::_idna::encode("www.example.com"), "www.example.com"; + is URI::_idna::decode("www.example.com"), "www.example.com"; +@@ -12,3 +13,20 @@ is URI::_idna::decode("www.example.com."), "www.example.com."; + is URI::_idna::encode("Bücher.ch"), "xn--bcher-kva.ch"; + is URI::_idna::decode("xn--bcher-kva.ch"), "bücher.ch"; + is URI::_idna::decode("xn--bcher-KVA.ch"), "bücher.ch"; ++ ++# nameprep must NFC-normalize a label before punycode encoding: a non-NFC ++# label otherwise encodes to a non-standard A-label that a security check and ++# the eventual fetch can disagree about. ++is URI::_idna::encode(chr(0x0958) . chr(0x093E)), "xn--11b2fg", ++ "precomposed Devanagari sequence is NFC-normalized before encoding"; ++ ++# The correct (NFC) A-label decodes and re-encodes back to itself. ++is URI::_idna::encode(URI::_idna::decode("xn--11b2fg")), "xn--11b2fg", ++ "NFC A-label round-trips through decode/encode"; ++ ++# The non-normalized precomposed A-label for the same name must be rejected ++# rather than silently decoded, so it can never stand in for the NFC host. ++like exception { URI::_idna::decode("xn--72b5c") }, qr/does not round-trip/, ++ "non-NFC A-label is rejected on decode"; ++ ++done_testing; +-- +2.45.4 + diff --git a/SPECS/perl-URI/perl-URI.spec b/SPECS/perl-URI/perl-URI.spec index 3171847de07..b4dfdfa5637 100644 --- a/SPECS/perl-URI/perl-URI.spec +++ b/SPECS/perl-URI/perl-URI.spec @@ -3,13 +3,14 @@ Name: perl-URI Version: 5.21 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A Perl module implementing URI parsing and manipulation License: GPL+ or Artistic Vendor: Microsoft Corporation Distribution: Azure Linux URL: https://metacpan.org/release/URI Source0: https://cpan.metacpan.org/authors/id/O/OA/OALDERS/URI-%{version}.tar.gz#/perl-URI-%{version}.tar.gz +Patch0: CVE-2026-19953.patch BuildArch: noarch # Module Build BuildRequires: coreutils @@ -70,6 +71,7 @@ updated by RFC 2732). %prep %setup -q -n URI-%{version} +%patch 0 -p1 chmod -c 644 uri-test %build @@ -92,6 +94,9 @@ make test %{_mandir}/man3/URI::*.3* %changelog +* Mon Sep 07 2026 Azure Linux Security Servicing Account - 5.21-3 +- Patch for CVE-2026-19953 + * Wed May 21 2025 Riken Maharjan - 5.21-2 - Fix ptest by adding missing runtime dep From 79614031ffcdfc97ba46f8d8087a0c8004bd92ac Mon Sep 17 00:00:00 2001 From: Akarsh Chaudhary Date: Tue, 8 Sep 2026 07:28:05 +0000 Subject: [PATCH 2/3] Minute change in the patch to make it in sync with upstream patch. --- SPECS/perl-URI/CVE-2026-19953.patch | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/SPECS/perl-URI/CVE-2026-19953.patch b/SPECS/perl-URI/CVE-2026-19953.patch index e075268d699..9378d092599 100644 --- a/SPECS/perl-URI/CVE-2026-19953.patch +++ b/SPECS/perl-URI/CVE-2026-19953.patch @@ -6,25 +6,24 @@ Subject: [PATCH] Normalize IDNA labels with NFC in nameprep [CVE-2026-19953] Signed-off-by: Azure Linux Security Servicing Account Upstream-reference: AI Backport of https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch --- - Changes | 7 +++++++ + Changes | 6 ++++++ cpanfile | 1 + lib/URI/_idna.pm | 21 ++++++++++++++++----- t/idna.t | 22 ++++++++++++++++++++-- - 4 files changed, 44 insertions(+), 7 deletions(-) + 4 files changed, 43 insertions(+), 7 deletions(-) diff --git a/Changes b/Changes index 536a0ce..841bb58 100644 --- a/Changes +++ b/Changes -@@ -1,5 +1,12 @@ +@@ -1,5 +1,11 @@ Revision history for URI -+{{}} ++{{$NEXT}} + - Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host + encoding matches other clients instead of emitting a non-standard, + non-round-tripping A-label [CVE-2026-19953] (reported by Naseeb Dangi, + @naseeb0) (GH#191) -+ + 5.21 2023-08-23 16:02:14Z - Fix version declarations in icap.pm and icaps.pm (GH#131) (Olaf Alders) From 982b875386ccb341787d797ae81248bad7f771d3 Mon Sep 17 00:00:00 2001 From: Akarsh Chaudhary Date: Tue, 8 Sep 2026 08:17:29 +0000 Subject: [PATCH 3/3] Adding autoetup in the prep section. --- SPECS/perl-URI/perl-URI.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/SPECS/perl-URI/perl-URI.spec b/SPECS/perl-URI/perl-URI.spec index b4dfdfa5637..9dbfee4aaf7 100644 --- a/SPECS/perl-URI/perl-URI.spec +++ b/SPECS/perl-URI/perl-URI.spec @@ -70,8 +70,7 @@ This module implements the URI class. Objects of this class represent updated by RFC 2732). %prep -%setup -q -n URI-%{version} -%patch 0 -p1 +%autosetup -p1 -n URI-%{version} chmod -c 644 uri-test %build