Re: [BLFS Trac] #23612: HTTP-Date-6.08

#23612: HTTP-Date-6.08
-------------------------+-------------------------------
 Reporter:  Joe Locash   |       Owner:  SecurityAdvisory
     Type:  enhancement  |      Status:  new
 Priority:  elevated     |   Milestone:  98-Security
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+-------------------------------
Changes (by Joe Locash):

 * milestone:  13.1 => 98-Security
 * owner:  Joe Locash => SecurityAdvisory
 * status:  assigned => new

Comment:

 {{{
 6.08      2026-07-09 02:04:21Z

     - [SECURITY] Reject input longer than 64 characters in parse_date()
       to prevent quadratic regex backtracking (a denial of service) on
       hostile date strings. Fixes CVE-2026-14741. (Olaf Alders)

 6.07      2026-06-25 15:12:09Z

     - Add test with Time::Zone (GH#25) (Michal Josef Špaček)
     - Add test with bad Time::Zone string (GH#26) (Michal Josef Špaček)
     - Add tests with negative time (GH#26) (Michal Josef Špaček)
     - Replace all instances of \d with [0-9] in regular expressions to
       reject non-ASCII Unicode digits, with a regression test (GH#27)
       (Robert Rothenberg)
     - Reject malformed ISO 8601 timezones with a doubled colon (GH#31)
       (Olaf Alders)
     - Document day/month/year ordering for numeric dates (GH#32) (Olaf
       Alders)
 }}}
 Fixed at [sha:c18cf7423e]. Leaving open for SA.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23612#comment:1>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page