libsql-abstract-perl - Debian Package Tracker

general

source: libsql-abstract-perl (main)
version: 2.000001-2
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: Xavier Guimard (DMD) – Ansgar Burchardt (DMD) – gregor herrmann (DMD)
arch: all
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.87-1
oldstable: 2.000001-2
stable: 2.000001-2
testing: 2.000001-2
unstable: 2.000001-2

versioned links

1.87-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.000001-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libsql-abstract-perl

action needed

3 security issues in trixie high

There are 3 open security issues in trixie.

3 important issues:

CVE-2026-121007: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
CVE-2026-121009: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

Created: 2026-11-04 Last update: 2026-11-05 05:00

3 security issues in sid high

There are 3 open security issues in sid.

3 important issues:

CVE-2026-121007: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
CVE-2026-121009: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

Created: 2026-11-04 Last update: 2026-11-05 05:00

3 security issues in forky high

There are 3 open security issues in forky.

3 important issues:

CVE-2026-121007: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
CVE-2026-121009: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

Created: 2026-11-04 Last update: 2026-11-05 05:00

3 security issues in bookworm high

There are 3 open security issues in bookworm.

3 important issues:

CVE-2026-121007: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identifier position. A nested statement such as { -select => ... } in a position where plain scalars are identifiers treats its own plain scalars as identifiers too. These positions are the select list, ORDER BY, GROUP BY, RETURNING, and with the ExtraClauses plugin FROM (-as) and JOIN (to). The values of the statement's where, having and set clauses, and the rows of a -values, go into the SQL text instead of the bind list, unescaped unless quote_char is set. Subselects in a WHERE condition are not affected. An application that passes untrusted input as a where value of such a nested statement, expecting it to be bound, allows SQL injection.
CVE-2026-121008: SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile. The html profile wraps keywords and placeholders in span elements and breaks lines with br elements, so its output is meant to go into a page as is. The format method does not HTML-escape the SQL text or the bind values it fills in around that markup. An application that renders SQL formatted with the html profile, such as in a debug panel or query log, allows an attacker who controls a bind value or part of the SQL text to embed JavaScript in the page.
CVE-2026-121009: SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.

Created: 2026-11-04 Last update: 2026-11-05 05:00

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 2.000001-3, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 190213e633a9e066c1a93c5291ea91b4661bc0ec
Author: gregor herrmann <gregoa@debian.org>
Date:   Wed Nov 4 23:32:13 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit 7202982a32af08b824bf0e0b64b84125df8dd221
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Jan 5 06:46:41 2023 +0000

    Update standards version to 4.6.2, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

Created: 2023-01-11 Last update: 2026-11-05 00:00

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2021-10-13 Last update: 2021-10-13 21:33

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.0).

Created: 2022-05-11 Last update: 2026-03-31 15:01

news

[rss feed]

[2021-10-31] libsql-abstract-perl 2.000001-2 MIGRATED to testing (Debian testing watch)
[2021-09-30] Accepted libsql-abstract-perl 2.000001-2 (source) into unstable (gregor herrmann)
[2021-09-27] Accepted libsql-abstract-perl 2.000001-1 (source) into unstable (gregor herrmann)
[2020-06-06] libsql-abstract-perl 1.87-1 MIGRATED to testing (Debian testing watch)
[2020-06-03] Accepted libsql-abstract-perl 1.87-1 (source) into unstable (gregor herrmann)
[2018-07-16] libsql-abstract-perl 1.86-1 MIGRATED to testing (Debian testing watch)
[2018-07-13] Accepted libsql-abstract-perl 1.86-1 (source) into unstable (Xavier Guimard) (signed by: gregor herrmann)
[2018-02-18] libsql-abstract-perl 1.85-1 MIGRATED to testing (Debian testing watch)
[2018-02-12] Accepted libsql-abstract-perl 1.85-1 (source) into unstable (Xavier Guimard) (signed by: gregor herrmann)
[2017-10-31] libsql-abstract-perl 1.84-1 MIGRATED to testing (Debian testing watch)
[2017-10-25] Accepted libsql-abstract-perl 1.84-1 (source) into unstable (Xavier Guimard) (signed by: gregor herrmann)
[2014-11-05] libsql-abstract-perl 1.81-1 MIGRATED to testing (Britney)
[2014-10-25] Accepted libsql-abstract-perl 1.81-1 (source all) into unstable (gregor herrmann)
[2014-10-17] libsql-abstract-perl 1.80-1 MIGRATED to testing (Britney)
[2014-10-06] Accepted libsql-abstract-perl 1.80-1 (source all) into unstable (gregor herrmann)
[2014-10-01] libsql-abstract-perl 1.79-1 MIGRATED to testing (Britney)
[2014-09-25] Accepted libsql-abstract-perl 1.79-1 (source all) into unstable (gregor herrmann)
[2014-06-13] libsql-abstract-perl 1.78-1 MIGRATED to testing (Debian testing watch)
[2014-06-07] Accepted libsql-abstract-perl 1.78-1 (source all) (gregor herrmann)
[2014-01-23] libsql-abstract-perl 1.77-1 MIGRATED to testing (Debian testing watch)
[2014-01-17] Accepted libsql-abstract-perl 1.77-1 (source all) (gregor herrmann)
[2014-01-16] libsql-abstract-perl 1.75-1 MIGRATED to testing (Debian testing watch)
[2014-01-10] Accepted libsql-abstract-perl 1.75-1 (source all) (gregor herrmann)
[2013-06-26] libsql-abstract-perl 1.74-1 MIGRATED to testing (Debian testing watch)
[2013-06-15] Accepted libsql-abstract-perl 1.74-1 (source all) (Xavier Guimard) (signed by: gregor herrmann)
[2013-05-05] libsql-abstract-perl 1.73-1 MIGRATED to testing (Debian testing watch)
[2012-07-24] Accepted libsql-abstract-perl 1.73-1 (source all) (Xavier Guimard) (signed by: gregor herrmann)
[2011-02-21] libsql-abstract-perl 1.72-1 MIGRATED to testing (Debian testing watch)
[2011-02-10] Accepted libsql-abstract-perl 1.72-1 (source all) (gregor herrmann)
[2010-06-19] libsql-abstract-perl 1.67-2 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.000001-2