[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <f8ecb7ca-4753-44cf-b0a0-dea7a3a6e00d@gmail.com>
Date: Sun, 29 Mar 2026 21:20:57 -0500
From: Jacob Bachmeyer <jcb62281@...il.com>
To: oss-security@...ts.openwall.com, Stig Palmquist <stig@...g.io>,
cve-announce@...urity.metacpan.org
Subject: Re: CVE-2026-4176: Perl versions from 5.9.4 before
5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain
a vulnerable version of Compress::Raw::Zlib
On 3/29/26 15:55, Stig Palmquist wrote:
> ========================================================================
> CVE-2026-4176 CPAN Security Group
> ========================================================================
>
> [...]
>
> Solutions
> ---------
> Update to Perl stable release 5.40.4 or 5.42.2 or later, which include
> Compress::Raw::Zlib 2.222.
You hint at the other solution under "Workarounds" but neglect to
actually mention it here:
For *any* Perl version, simply install Compress::Raw::Zlib 2.222 from CPAN.
-- Jacob
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
