Updated perl-Net-OAuth packages fix security vulnerabilities
Publication date: 02 Sep 2026Modification date: 02 Sep 2026
Type: security
Affected Mageia releases : 10 , 9
CVE: CVE-2026-72887 , CVE-2026-72888 , CVE-2026-72889 , CVE-2026-75589
Description
Net::OAuth::Client versions before 0.32 for Perl allow the service
provider to silently downgrade OAuth 1.0a to OAuth 1.0 in
get_request_token
Net::OAuth versions before 0.32 for Perl allow memory exhaustion via
unbounded caching of failed module loads in smart_require
Net::OAuth versions before 0.33 for Perl allow the sender to choose the
signature algorithm in verify
Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256
and PLAINTEXT signatures with a non-constant-time comparison in verify
References
- https://bugs.mageia.org/show_bug.cgi?id=36145
- https://www.openwall.com/lists/oss-security/2026/08/16/3
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-jh72-4qq2-8j6g
- https://www.openwall.com/lists/oss-security/2026/08/16/4
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-m2cv-cq5x-47ph
- https://www.openwall.com/lists/oss-security/2026/08/19/2
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-c8rm-g5cm-4pf5
- https://www.openwall.com/lists/oss-security/2026/08/19/3
- https://github.com/vurtdev/Net-OAuth/security/advisories/GHSA-g8xr-69p3-gw56
- https://www.cve.org/CVERecord?id=CVE-2026-72887
- https://www.cve.org/CVERecord?id=CVE-2026-72888
- https://www.cve.org/CVERecord?id=CVE-2026-72889
- https://www.cve.org/CVERecord?id=CVE-2026-75589
SRPMS
10/core
- perl-Net-OAuth-0.330.0-1.mga10
9/core
- perl-Net-OAuth-0.330.0-1.mga9