Mock Version: 6.0 Mock Version: 6.0 Mock Version: 6.0 ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --noclean --target noarch --nodeps /builddir/build/SPECS/perl-HTTP-Date.spec'], chrootPath='/var/lib/mock/dist-an23-build-569185-92560/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=timeout=86400uid=982gid=135user='mockbuild'unshare_net=TrueprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock']) Executing command: ['bash', '--login', '-c', '/usr/bin/rpmbuild -bs --noclean --target noarch --nodeps /builddir/build/SPECS/perl-HTTP-Date.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'} and shell False Building target platforms: noarch Building for target noarch setting SOURCE_DATE_EPOCH=1787097600 Wrote: /builddir/build/SRPMS/perl-HTTP-Date-6.05-3.an23.src.rpm Child return code was: 0 ENTER ['do_with_status'](['bash', '--login', '-c', '/usr/bin/rpmbuild -bb --noclean --target noarch --nodeps /builddir/build/SPECS/perl-HTTP-Date.spec'], chrootPath='/var/lib/mock/dist-an23-build-569185-92560/root'env={'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'}shell=Falselogger=timeout=86400uid=982gid=135user='mockbuild'unshare_net=TrueprintOutput=Falsenspawn_args=['--capability=cap_ipc_lock']) Executing command: ['bash', '--login', '-c', '/usr/bin/rpmbuild -bb --noclean --target noarch --nodeps /builddir/build/SPECS/perl-HTTP-Date.spec'] with env {'TERM': 'vt100', 'SHELL': '/bin/bash', 'HOME': '/builddir', 'HOSTNAME': 'mock', 'PATH': '/usr/bin:/bin:/usr/sbin:/sbin', 'PROMPT_COMMAND': 'printf "\\033]0;\\007"', 'PS1': ' \\s-\\v\\$ ', 'LANG': 'C.UTF-8'} and shell False Building target platforms: noarch Building for target noarch setting SOURCE_DATE_EPOCH=1787097600 Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.hkYxAM + umask 022 + cd /builddir/build/BUILD + cd /builddir/build/BUILD + rm -rf HTTP-Date-6.05 + /usr/lib/rpm/rpmuncompress -x /builddir/build/SOURCES/HTTP-Date-6.05.tar.gz + STATUS=0 + '[' 0 -ne 0 ']' + cd HTTP-Date-6.05 + /usr/bin/chmod -Rf a+rX,u+w,g-w,o-w . + /usr/lib/rpm/rpmuncompress /builddir/build/SOURCES/CVE-2026-14741.patch + /usr/bin/patch -s --fuzz=0 --no-backup-if-mismatch -f The text leading up to this was: -------------------------- |From 78c20952cdfbf11e03cf1199ad70f13298a84c5c Mon Sep 17 00:00:00 2001 |From: Olaf Alders |Date: Sat, 4 Jul 2026 17:38:49 +0000 |Subject: [PATCH] Fix ReDoS in parse_date (CVE-2026-14741) | |parse_date() -- and str2time(), which delegates to it -- used regexes with |ambiguous adjacent greedy runs (year/clock/timezone digits and |timezone/ASCII-timezone letters) before a trailing anchor. A valid-looking |date prefix followed by a long interior run of digits, letters, or whitespace |and a trailing junk character forced O(N^2) backtracking, so a ~100 KB string |burned tens of seconds of CPU: a denial of service. | |Guard parse_date() with an up-front length check (reject input longer than |64 characters) so hostile strings are rejected before any regex runs. The |check is on the untrimmed string, so no work happens on padded input. The cap |is a hardcoded security limit, not a tunable: every format the module |recognizes is far shorter, and the parsing regexes still contain adjacent |unbounded quantifiers, so raising it would demand re-benchmarking against |hostile input. The cap also bounds the substring later handed to Time::Zone. | |Add t/redos.t covering the guard, the exact length boundary, and the digit, |letter, and whitespace DoS vectors. | |Fixes CVE-2026-14741. | |Co-Authored-By: Claude Opus 4.8 |Adapted-by: PengLAI Code |--- | lib/HTTP/Date.pm | 14 ++++++++++++++ | t/redos.t | 80 ++++++++++++++++++++++++++++++ | 2 files changed, 94 insertions(+) | |diff --git a/lib/HTTP/Date.pm b/lib/HTTP/Date.pm |index a57d0b8..bce8a7c 100644 |--- a/lib/HTTP/Date.pm |+++ b/lib/HTTP/Date.pm -------------------------- No file to patch. Skipping patch. 2 out of 2 hunks ignored RPM build errors: error: Bad exit status from /var/tmp/rpm-tmp.hkYxAM (%prep) Bad exit status from /var/tmp/rpm-tmp.hkYxAM (%prep) Child return code was: 1 EXCEPTION: [Error("Command failed: \n # bash --login -c '/usr/bin/rpmbuild -bb --noclean --target noarch --nodeps /builddir/build/SPECS/perl-HTTP-Date.spec'\n", 1)] Traceback (most recent call last): File "/usr/lib/python3.6/site-packages/mockbuild/trace_decorator.py", line 93, in trace result = func(*args, **kw) File "/usr/lib/python3.6/site-packages/mockbuild/util.py", line 610, in do_with_status raise exception.Error("Command failed: \n # %s\n%s" % (cmd_pretty(command, env), output), child.returncode) mockbuild.exception.Error: Command failed: # bash --login -c '/usr/bin/rpmbuild -bb --noclean --target noarch --nodeps /builddir/build/SPECS/perl-HTTP-Date.spec'