CVS commit: pkgsrc/mail/p5-MIME-tools

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Wed Oct 28 21:58:18 UTC 2026

Modified Files:
        pkgsrc/mail/p5-MIME-tools: Makefile distinfo

Log Message:
p5-MIME-tools: update to 5.522.

5.522     2026-10-27  Dianne Skoll <dianne%skoll.ca@localhost>

        * VERSION 5.522 RELEASED

        * Many security issues were addressed (see the following ten CVEs)
          Issues were brought to my attention, and patches supplied, by the
          CPANSec security group.

        * parse_params: flag a parameter list that could not be parsed
          Detect additional ambiguous parse situations when parameter
          names contain illegal characters.  Fixes:
          CVE-2026-116264 invalid parameter hides boundary/filename

        * parse_params: check the boundary after RFC 2231 reassembly
          Another ambiguous-parse case was missed (trailing space after
          boundary was not detected for RFC-2231-encoded boundaries.)  Fixes:
          CVE-2026-116265 RFC 2231 boundary skips ambiguity checks

        * parse_params: Stricter checking for encoded boundaries; earlier
          versions would miss some cases.  Fixes:
          CVE-2026-116266 boundary changed by decoding not flagged

        * Cap the indentation levels in the Results: structure.  Otherwise,
          specially-crafted messages could consume large amounts of memory.
          Fixes: CVE-2026-116267 indent stored per message per level

        * parse_params: stop a comment match at the next parenthesis.
          Otherwise, specially-crafted messages could cause the regex
          back-tracker to consume large amounts of CPU time.  Note that
          MIME::Parser does not correctly parse ((nested comments)) and
          has never done so.  Fixes:
          CVE-2026-116268 unclosed "(" comments backtrack CPU exhaustion

        * parse_params: re-encode filename* values without charset tricks
          Specially-crafted messages could trick recommended_filename()
          into returning an empty string instead of a plausible filename.
          Fixes: CVE-2026-116269 RFC 2231 language tag empties filename

        * decode_mimewords: do not copy the input into each error.  Otherwise,
          specially-crafted messages could consume large amounts of memory.
          Fixes: CVE-2026-116270 each bad "=?" copies the input into $@

        * FileUnder: do not reuse an existing generated directory.  Otherwise,
          attackers might be able to use symbolic links to get files created
          in unexpected locations.  Fixes:
          CVE-2026-116271 FileUnder reuses a pre-created directory

        * parse_params: flag comments other readers do not skip
          Specially-crafted messages could create ambiguous messages without
          setting the ambiguous_parse flag.  Fixes:
          CVE-2026-116272  comment hides a duplicate boundary

        * Call whine() rather than error() if max_parts or max_depth is
          exceeded during a parse.  This lets us return undef rather than
          throwing an exception if ignore_errors() is set to 0.

        * Change to defaults: max_parts is now set to 1000 and max_depth
          to 64 rather than being unlimited.  This should not affect most
          real-world uses of MIME::tools, but you may need to increase
          these values or set them to -1 (unlimited) if you run into trouble.

              ***** NOTE INCOMPATIBILITY *****

          Fixes: CVE-2026-116273 max_parts and max_depth unlimited

        * Do not signal an ambiguous parse if we have filename="" or
          name=""

        * Update author names in META.yml

        * Add git repo to META.yml

5.520     2026-10-21  Dianne Skoll <dianne%skoll.ca@localhost>

        * VERSION 5.520 RELEASED

        * MIME::Parser used O(N^2) CPU time and memory parsing a MIME
          message nested N levels deep.  A smallish specially-crafted
          message could DOS the computer by making it consume enormous
          amounts of memory and CPU time.  The parser was modified to use
          O(N) time and memory in this case.  Additionally, a new
          MIME::Parser::max_depth() function was added to limit the nesting
          depth before declaring a parse failure.  Problem was reported to
          me by Zhaoyang Li and Xiang Li from AOSP Lab at Nankai University.

        * MIME::Parser would ignore multiple blank lines in a message
          preamble when parsing it; this could break DKIM.  Problem pointed
          out and fix suggested by Tim Henderson.

        * If a MIME boundary includes trailing whitespace, we mark the
          parse as ambiguous.  Problem noted and patch submitted by
          Christian Herdtweck

5.519     2026-09-22  Dianne Skoll <dianne%skoll.ca@localhost>

        * VERSION 5.519 RELEASED

        * Some (buggy) software creates base64-encoded parts as a
          concatenation of multiple base64-encoded streams, and some client
          software decodes each stream separately and concatenates the
          results.  Duplicate this behavior in MIME::tools to prevent it
          from being used as a mechanism to sneak dangerous content past a
          security scanner.  Patch courtesy of Giorgio Premi
          <giosh94mhz%gmail.com@localhost>.

5.518     2026-08-26  Dianne Skoll <dianne%skoll.ca@localhost>

        * VERSION 5.518 RELEASED

        * Add tests for encoded "boundary=XXX" parameters and set
          the ambiguous-parse flag if any are found.  Patch courtesy
          of Dominik Csapak <d.csapak%proxmox.com@localhost>

          MIME::tools chooses to decode encoded boundary parameters.
          MUA behaviors differ; Claws-Mail decodes them while Thunderbird
          does not.

        * Don't ignore invalid whitespace after "boundary=XXX" parameter.
          Patch courtesy of Dominik Csapak <d.csapak%proxmox.com@localhost>

        * Ignore comments between tokens.  A header parameter can be
          written foo(comment)=bar and it's the same as foo=bar.
          Patch courtesy of Dominik Csapak <d.csapak%proxmox.com@localhost>


To generate a diff of this commit:
cvs rdiff -u -r1.72 -r1.73 pkgsrc/mail/p5-MIME-tools/Makefile
cvs rdiff -u -r1.29 -r1.30 pkgsrc/mail/p5-MIME-tools/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/mail/p5-MIME-tools/Makefile
diff -u pkgsrc/mail/p5-MIME-tools/Makefile:1.72 pkgsrc/mail/p5-MIME-tools/Makefile:1.73
--- pkgsrc/mail/p5-MIME-tools/Makefile:1.72     Wed Aug 19 03:10:14 2026
+++ pkgsrc/mail/p5-MIME-tools/Makefile  Wed Oct 28 21:58:18 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.72 2026/08/19 03:10:14 wen Exp $
+# $NetBSD: Makefile,v 1.73 2026/10/28 21:58:18 wiz Exp $
 
-DISTNAME=      MIME-tools-5.517
+DISTNAME=      MIME-tools-5.522
 PKGNAME=       p5-${DISTNAME}
-CATEGORIES=    perl5
+CATEGORIES=    mail perl5
 MASTER_SITES=  ${MASTER_SITE_PERL_CPAN:=../../authors/id/D/DS/DSKOLL/}
 
 MAINTAINER=    pkgsrc-users%NetBSD.org@localhost

Index: pkgsrc/mail/p5-MIME-tools/distinfo
diff -u pkgsrc/mail/p5-MIME-tools/distinfo:1.29 pkgsrc/mail/p5-MIME-tools/distinfo:1.30
--- pkgsrc/mail/p5-MIME-tools/distinfo:1.29     Wed Aug 19 03:10:14 2026
+++ pkgsrc/mail/p5-MIME-tools/distinfo  Wed Oct 28 21:58:18 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.29 2026/08/19 03:10:14 wen Exp $
+$NetBSD: distinfo,v 1.30 2026/10/28 21:58:18 wiz Exp $
 
-BLAKE2s (MIME-tools-5.517.tar.gz) = e17811059aeff12c8c28898ac441abe819fc70b6556798c3f00a765f6b2d11da
-SHA512 (MIME-tools-5.517.tar.gz) = e7935a1f4219b5de87f5752cf87978083ffe55ebd6a929f8f9fed63595553059fed6fe98ee18f151b0a250a57d8f239ba8ebd5d34b5e5d407b30ed9a5de95547
-Size (MIME-tools-5.517.tar.gz) = 425046 bytes
+BLAKE2s (MIME-tools-5.522.tar.gz) = 9edf58b362877757dfbd4bc697b04dae9541e6153da09c0f89128bcb1f0c8452
+SHA512 (MIME-tools-5.522.tar.gz) = ced238b1b40b855edcf803cc86b95d92a2fd88002fa07c8ef2e590e32340239f603b631ed97116d4d165e0b6fb0430a4d72f92f9ce19ff6cab2b085b42a6b1a8
+Size (MIME-tools-5.522.tar.gz) = 441525 bytes