Bug 2476481

Summary:	perl-libwww-perl-6.83 is available
Product:	[Fedora] Fedora	Reporter:	Upstream Release Monitoring <upstream-release-monitoring>
Component:	perl-libwww-perl	Assignee:	Michal Josef Spacek <mspacek>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	kasal, mspacek, perl-devel, rstrode
Target Milestone:	---	Keywords:	FutureFeature, Triaged
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	perl-libwww-perl-6.83-1.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-31 00:55:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Upstream Release Monitoring 2026-05-12 14:48:54 UTC

Releases retrieved: 6.83
Upstream release that is considered latest: 6.83
Current version/release in rawhide: 6.82-1.fc45
URL: https://metacpan.org/dist/libwww-perl/

Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/


More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_Monitoring


Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream.


Based on the information from Anitya: https://release-monitoring.org/project/3024/


To change the monitoring settings for the project, please visit:
https://src.fedoraproject.org/rpms/perl-libwww-perl

Comment 1 Michal Josef Spacek 2026-05-19 14:51:44 UTC

6.83      2026-05-12 11:41:48Z
    - LWP::UserAgent now strips Authorization and Proxy-Authorization headers
      on cross-origin redirects (a different scheme, host, or port) to prevent
      credential leakage to the redirect target. Same-origin redirects retain
      credentials. Opt out with allow_credentialed_redirects => 1.
      CVE-2026-8368 reported by Kai Zen; PoC and initial patch by Stig
      Palmquist.
    - LWP::UserAgent now refuses https to http redirects by default to prevent
      leaking remaining request headers and bodies over plaintext. Opt in with
      allow_downgrade => 1. Related hardening alongside CVE-2026-8368; PoC by
      Stig Palmquist.


For Fedora Rawhide, F44 and F43

Comment 2 Fedora Update System 2026-05-20 20:42:01 UTC

FEDORA-2026-8d1333fb52 (perl-libwww-perl-6.83-1.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-8d1333fb52

Comment 3 Fedora Update System 2026-05-21 02:35:34 UTC

FEDORA-2026-8d1333fb52 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-8d1333fb52`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-8d1333fb52

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2026-05-31 00:55:21 UTC

FEDORA-2026-8d1333fb52 (perl-libwww-perl-6.83-1.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.