[AutoPR- Security] Patch perl-URI for CVE-2026-19953 [MEDIUM]

SPECS/perl-URI/CVE-2026-19953.patch

@@ -0,0 +1,122 @@
+From 471e9e657e8112491205773c55ffff77d6db4b65 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Mon, 7 Sep 2026 04:47:41 +0000
+Subject: [PATCH] Normalize IDNA labels with NFC in nameprep [CVE-2026-19953]
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/libwww-perl/URI/commit/956619a9e94f86d8d2c529b4e06a3674c54a73e7.patch
+---
+ Changes          |  6 ++++++
+ cpanfile         |  1 +
+ lib/URI/_idna.pm | 21 ++++++++++++++++-----
+ t/idna.t         | 22 ++++++++++++++++++++--
+ 4 files changed, 43 insertions(+), 7 deletions(-)
+
+diff --git a/Changes b/Changes
+index 536a0ce..841bb58 100644
+--- a/Changes
++++ b/Changes
+@@ -1,5 +1,11 @@
+ Revision history for URI
+
++{{$NEXT}}
++    - Apply Unicode NFC normalization in URI::_idna nameprep so IDNA host
++      encoding matches other clients instead of emitting a non-standard,
++      non-round-tripping A-label [CVE-2026-19953] (reported by Naseeb Dangi,
++      @naseeb0) (GH#191)
++
+ 5.21      2023-08-23 16:02:14Z
+     - Fix version declarations in icap.pm and icaps.pm (GH#131) (Olaf Alders)
+
+diff --git a/cpanfile b/cpanfile
+index 467f4b7..8ca0da7 100644
+--- a/cpanfile
++++ b/cpanfile
+@@ -31,6 +31,7 @@ on 'runtime' => sub {
+     requires "MIME::Base64" => "2";
+     requires "Net::Domain" => "0";
+     requires "Scalar::Util" => "0";
++    requires "Unicode::Normalize" => "0";
+     requires "constant" => "0";
+     requires "integer" => "0";
+     requires "overload" => "0";
+diff --git a/lib/URI/_idna.pm b/lib/URI/_idna.pm
+index 5d4a016..ea3f802 100644
+--- a/lib/URI/_idna.pm
++++ b/lib/URI/_idna.pm
+@@ -6,8 +6,9 @@ package URI::_idna;
+ use strict;
+ use warnings;
+
+-use URI::_punycode qw(decode_punycode encode_punycode);
+-use Carp qw(croak);
++use URI::_punycode     qw(decode_punycode encode_punycode);
++use Unicode::Normalize qw(NFC);
++use Carp               qw(croak);
+
+ our $VERSION = '5.21';
+
+@@ -38,10 +39,20 @@ sub decode {
+     return join(".", map ToUnicode($_), split(/\./, $domain, -1))
+ }
+
+-sub nameprep { # XXX real implementation missing
++sub nameprep {
+     my $label = shift;
+-    $label = lc($label);
+-    return $label;
++
++    # Lowercase, then normalize. Without normalization a non-NFC label encodes
++    # to a non-standard A-label that other IDNA implementations reject, so a
++    # host used for a security check can differ from the host actually fetched.
++    # We normalize with NFC (canonical composition): RFC 3491 (IDNA2003)
++    # nominally called for NFKC, but RFC 5891 (IDNA2008) replaced that with NFC,
++    # which is also what UTS #46 applies in browsers and other clients. The
++    # prohibited-character and bidi tables that a full nameprep would enforce
++    # remain unimplemented. A host passed as bytes rather than decoded
++    # characters is treated as Latin-1 per URI's documented contract (see the
++    # host/ihost examples in URI.pm), so pass decoded characters for UTF-8.
++    return NFC(lc $label);
+ }
+
+ sub check_size {
+diff --git a/t/idna.t b/t/idna.t
+index 37434b0..8dbde2a 100644
+--- a/t/idna.t
++++ b/t/idna.t
+@@ -2,8 +2,9 @@ use strict;
+ use warnings;
+
+ use utf8;
+-use Test::More tests => 7;
+-use URI::_idna ();
++use Test::More;
++use Test::Fatal qw( exception );
++use URI::_idna  ();
+
+ is URI::_idna::encode("www.example.com"), "www.example.com";
+ is URI::_idna::decode("www.example.com"), "www.example.com";
+@@ -12,3 +13,20 @@ is URI::_idna::decode("www.example.com."), "www.example.com.";
+ is URI::_idna::encode("Bücher.ch"), "xn--bcher-kva.ch";
+ is URI::_idna::decode("xn--bcher-kva.ch"), "bücher.ch";
+ is URI::_idna::decode("xn--bcher-KVA.ch"), "bücher.ch";
++
++# nameprep must NFC-normalize a label before punycode encoding: a non-NFC
++# label otherwise encodes to a non-standard A-label that a security check and
++# the eventual fetch can disagree about.
++is URI::_idna::encode(chr(0x0958) . chr(0x093E)), "xn--11b2fg",
++    "precomposed Devanagari sequence is NFC-normalized before encoding";
++
++# The correct (NFC) A-label decodes and re-encodes back to itself.
++is URI::_idna::encode(URI::_idna::decode("xn--11b2fg")), "xn--11b2fg",
++    "NFC A-label round-trips through decode/encode";
++
++# The non-normalized precomposed A-label for the same name must be rejected
++# rather than silently decoded, so it can never stand in for the NFC host.
++like exception { URI::_idna::decode("xn--72b5c") }, qr/does not round-trip/,
++    "non-NFC A-label is rejected on decode";
++
++done_testing;
+-- 
+2.45.4
+

SPECS/perl-URI/perl-URI.spec

@@ -3,13 +3,14 @@
 
 Name:           perl-URI
 Version:        5.21
-Release:        2%{?dist}
+Release:        3%{?dist}
 Summary:        A Perl module implementing URI parsing and manipulation
 License:        GPL+ or Artistic
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 URL:            https://metacpan.org/release/URI
 Source0:        https://cpan.metacpan.org/authors/id/O/OA/OALDERS/URI-%{version}.tar.gz#/perl-URI-%{version}.tar.gz
+Patch0:         CVE-2026-19953.patch
 BuildArch:      noarch
 # Module Build
 BuildRequires:  coreutils
@@ -69,7 +70,7 @@ This module implements the URI class. Objects of this class represent
 updated by RFC 2732).
 
 %prep
-%setup -q -n URI-%{version}
+%autosetup -p1 -n URI-%{version}
 chmod -c 644 uri-test
 
 %build
@@ -92,6 +93,9 @@ make test
 %{_mandir}/man3/URI::*.3*
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 5.21-3
+- Patch for CVE-2026-19953
+
 * Wed May 21 2025 Riken Maharjan <rmaharjan@microsoft.com> - 5.21-2
 - Fix ptest by adding missing runtime dep