diff --git a/SOURCES/perl-5.26.3-CVE-2020-12723.patch b/SOURCES/perl-5.26.3-CVE-2020-12723.patch
new file mode 100644
index 0000000..a98c81f
--- /dev/null
+++ b/SOURCES/perl-5.26.3-CVE-2020-12723.patch
@@ -0,0 +1,279 @@
+From c031e3ec7c713077659f5f7dc6638d926c69d7b2 Mon Sep 17 00:00:00 2001
+From: Hugo van der Sanden <hv@crypt.org>
+Date: Sat, 11 Apr 2020 14:10:24 +0100
+Subject: [PATCH v528 3/3] study_chunk: avoid mutating regexp program within
+ GOSUB
+
+gh16947 and gh17743: studying GOSUB may restudy in an inner call
+(via a mix of recursion and enframing) something that an outer call
+is in the middle of looking at. Let the outer frame deal with it.
+
+(CVE-2020-12723)
+---
+ embed.fnc | 2 +-
+ embed.h | 2 +-
+ proto.h | 2 +-
+ regcomp.c | 48 ++++++++++++++++++++++++++++++++----------------
+ t/re/pat.t | 26 +++++++++++++++++++++++++-
+ 5 files changed, 60 insertions(+), 20 deletions(-)
+
+diff --git a/embed.fnc b/embed.fnc
+index cf89277163..4b1ba28277 100644
+--- a/embed.fnc
++++ b/embed.fnc
+@@ -2397,7 +2397,7 @@ Es |SSize_t|study_chunk |NN RExC_state_t *pRExC_state \
+ |NULLOK struct scan_data_t *data \
+ |I32 stopparen|U32 recursed_depth \
+ |NULLOK regnode_ssc *and_withp \
+- |U32 flags|U32 depth
++ |U32 flags|U32 depth|bool was_mutate_ok
+ EsRn |U32 |add_data |NN RExC_state_t* const pRExC_state \
+ |NN const char* const s|const U32 n
+ rs |void |re_croak2 |bool utf8|NN const char* pat1|NN const char* pat2|...
+diff --git a/embed.h b/embed.h
+index 886551ce5c..50fcabc140 100644
+--- a/embed.h
++++ b/embed.h
+@@ -1075,7 +1075,7 @@
+ #define ssc_is_cp_posixl_init S_ssc_is_cp_posixl_init
+ #define ssc_or(a,b,c) S_ssc_or(aTHX_ a,b,c)
+ #define ssc_union(a,b,c) S_ssc_union(aTHX_ a,b,c)
+-#define study_chunk(a,b,c,d,e,f,g,h,i,j,k) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k)
++#define study_chunk(a,b,c,d,e,f,g,h,i,j,k,l) S_study_chunk(aTHX_ a,b,c,d,e,f,g,h,i,j,k,l)
+ # endif
+ # if defined(PERL_IN_REGCOMP_C) || defined (PERL_IN_DUMP_C)
+ #define _invlist_dump(a,b,c,d) Perl__invlist_dump(aTHX_ a,b,c,d)
+diff --git a/proto.h b/proto.h
+index d3f8802c1d..e276f69bd1 100644
+--- a/proto.h
++++ b/proto.h
+@@ -5258,7 +5258,7 @@ PERL_STATIC_INLINE void S_ssc_union(pTHX_ regnode_ssc *ssc, SV* const invlist, c
+ #define PERL_ARGS_ASSERT_SSC_UNION \
+ assert(ssc); assert(invlist)
+ #endif
+-STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth);
++STATIC SSize_t S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp, SSize_t *minlenp, SSize_t *deltap, regnode *last, struct scan_data_t *data, I32 stopparen, U32 recursed_depth, regnode_ssc *and_withp, U32 flags, U32 depth, bool was_mutate_ok);
+ #define PERL_ARGS_ASSERT_STUDY_CHUNK \
+ assert(pRExC_state); assert(scanp); assert(minlenp); assert(deltap); assert(last)
+ #endif
+diff --git a/regcomp.c b/regcomp.c
+index 0a9c6a8085..e66032a16a 100644
+--- a/regcomp.c
++++ b/regcomp.c
+@@ -110,6 +110,7 @@ typedef struct scan_frame {
+ regnode *next_regnode; /* next node to process when last is reached */
+ U32 prev_recursed_depth;
+ I32 stopparen; /* what stopparen do we use */
++ bool in_gosub; /* this or an outer frame is for GOSUB */
+ U32 is_top_frame; /* what flags do we use? */
+
+ struct scan_frame *this_prev_frame; /* this previous frame */
+@@ -4102,7 +4103,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ I32 stopparen,
+ U32 recursed_depth,
+ regnode_ssc *and_withp,
+- U32 flags, U32 depth)
++ U32 flags, U32 depth, bool was_mutate_ok)
+ /* scanp: Start here (read-write). */
+ /* deltap: Write maxlen-minlen here. */
+ /* last: Stop before this one. */
+@@ -4179,6 +4180,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ node length to get a real minimum (because
+ the folded version may be shorter) */
+ bool unfolded_multi_char = FALSE;
++ /* avoid mutating ops if we are anywhere within the recursed or
++ * enframed handling for a GOSUB: the outermost level will handle it.
++ */
++ bool mutate_ok = was_mutate_ok && !(frame && frame->in_gosub);
+ /* Peephole optimizer: */
+ DEBUG_STUDYDATA("Peep:", data, depth);
+ DEBUG_PEEP("Peep", scan, depth);
+@@ -4189,7 +4194,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ * parsing code, as each (?:..) is handled by a different invocation of
+ * reg() -- Yves
+ */
+- JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
++ if (mutate_ok)
++ JOIN_EXACT(scan,&min_subtract, &unfolded_multi_char, 0);
+
+ /* Follow the next-chain of the current node and optimize
+ away all the NOTHINGs from it. */
+@@ -4238,7 +4244,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ * NOTE we dont use the return here! */
+ (void)study_chunk(pRExC_state, &scan, &minlen,
+ &deltanext, next, &data_fake, stopparen,
+- recursed_depth, NULL, f, depth+1);
++ recursed_depth, NULL, f, depth+1, mutate_ok);
+
+ scan = next;
+ } else
+@@ -4305,7 +4311,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ /* we suppose the run is continuous, last=next...*/
+ minnext = study_chunk(pRExC_state, &scan, minlenp,
+ &deltanext, next, &data_fake, stopparen,
+- recursed_depth, NULL, f,depth+1);
++ recursed_depth, NULL, f, depth+1,
++ mutate_ok);
+
+ if (min1 > minnext)
+ min1 = minnext;
+@@ -4372,9 +4379,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ }
+ }
+
+- if (PERL_ENABLE_TRIE_OPTIMISATION &&
+- OP( startbranch ) == BRANCH )
+- {
++ if (PERL_ENABLE_TRIE_OPTIMISATION
++ && OP(startbranch) == BRANCH
++ && mutate_ok
++ ) {
+ /* demq.
+
+ Assuming this was/is a branch we are dealing with: 'scan'
+@@ -4825,6 +4833,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ newframe->stopparen = stopparen;
+ newframe->prev_recursed_depth = recursed_depth;
+ newframe->this_prev_frame= frame;
++ newframe->in_gosub = (
++ (frame && frame->in_gosub) || OP(scan) == GOSUB
++ );
+
+ DEBUG_STUDYDATA("frame-new:",data,depth);
+ DEBUG_PEEP("fnew", scan, depth);
+@@ -5043,7 +5054,7 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ (mincount == 0
+ ? (f & ~SCF_DO_SUBSTR)
+ : f)
+- ,depth+1);
++ , depth+1, mutate_ok);
+
+ if (flags & SCF_DO_STCLASS)
+ data->start_class = oclass;
+@@ -5105,7 +5116,9 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ if ( OP(oscan) == CURLYX && data
+ && data->flags & SF_IN_PAR
+ && !(data->flags & SF_HAS_EVAL)
+- && !deltanext && minnext == 1 ) {
++ && !deltanext && minnext == 1
++ && mutate_ok
++ ) {
+ /* Try to optimize to CURLYN. */
+ regnode *nxt = NEXTOPER(oscan) + EXTRA_STEP_2ARGS;
+ regnode * const nxt1 = nxt;
+@@ -5151,10 +5164,10 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ && !(data->flags & SF_HAS_EVAL)
+ && !deltanext /* atom is fixed width */
+ && minnext != 0 /* CURLYM can't handle zero width */
+-
+ /* Nor characters whose fold at run-time may be
+ * multi-character */
+ && ! (RExC_seen & REG_UNFOLDED_MULTI_SEEN)
++ && mutate_ok
+ ) {
+ /* XXXX How to optimize if data == 0? */
+ /* Optimize to a simpler form. */
+@@ -5201,7 +5214,8 @@ S_study_chunk(pTHX_ RExC_state_t *pRExC_state, regnode **scanp,
+ #endif
+ /* Optimize again: */
+ study_chunk(pRExC_state, &nxt1, minlenp, &deltanext, nxt,
+- NULL, stopparen, recursed_depth, NULL, 0,depth+1);
++ NULL, stopparen, recursed_depth, NULL, 0,
++ depth+1, mutate_ok);
+ }
+ else
+ oscan->flags = 0;
+@@ -5592,7 +5606,8 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n",
+ nscan = NEXTOPER(NEXTOPER(scan));
+ minnext = study_chunk(pRExC_state, &nscan, minlenp, &deltanext,
+ last, &data_fake, stopparen,
+- recursed_depth, NULL, f, depth+1);
++ recursed_depth, NULL, f, depth+1,
++ mutate_ok);
+ if (scan->flags) {
+ if (deltanext) {
+ FAIL("Variable length lookbehind not implemented");
+@@ -5681,7 +5696,7 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n",
+ *minnextp = study_chunk(pRExC_state, &nscan, minnextp,
+ &deltanext, last, &data_fake,
+ stopparen, recursed_depth, NULL,
+- f,depth+1);
++ f, depth+1, mutate_ok);
+ if (scan->flags) {
+ if (deltanext) {
+ FAIL("Variable length lookbehind not implemented");
+@@ -5841,7 +5856,8 @@ Perl_re_printf( aTHX_ "LHS=%" UVuf " RHS=%" UVuf "\n",
+ branches even though they arent otherwise used. */
+ minnext = study_chunk(pRExC_state, &scan, minlenp,
+ &deltanext, (regnode *)nextbranch, &data_fake,
+- stopparen, recursed_depth, NULL, f,depth+1);
++ stopparen, recursed_depth, NULL, f, depth+1,
++ mutate_ok);
+ }
+ if (nextbranch && PL_regkind[OP(nextbranch)]==BRANCH)
+ nextbranch= regnext((regnode*)nextbranch);
+@@ -7524,7 +7540,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
+ &data, -1, 0, NULL,
+ SCF_DO_SUBSTR | SCF_WHILEM_VISITED_POS | stclass_flag
+ | (restudied ? SCF_TRIE_DOING_RESTUDY : 0),
+- 0);
++ 0, TRUE);
+
+
+ CHECK_RESTUDY_GOTO_butfirst(LEAVE_with_name("study_chunk"));
+@@ -7670,7 +7686,7 @@ Perl_re_op_compile(pTHX_ SV ** const patternp, int pat_count,
+ SCF_DO_STCLASS_AND|SCF_WHILEM_VISITED_POS|(restudied
+ ? SCF_TRIE_DOING_RESTUDY
+ : 0),
+- 0);
++ 0, TRUE);
+
+ CHECK_RESTUDY_GOTO_butfirst(NOOP);
+
+diff --git a/t/re/pat.t b/t/re/pat.t
+index 1d98fe77d7..1488259b02 100644
+--- a/t/re/pat.t
++++ b/t/re/pat.t
+@@ -23,7 +23,7 @@ BEGIN {
+ skip_all('no re module') unless defined &DynaLoader::boot_DynaLoader;
+ skip_all_without_unicode_tables();
+
+-plan tests => 840; # Update this when adding/deleting tests.
++plan tests => 844; # Update this when adding/deleting tests.
+
+ run_tests() unless caller;
+
+@@ -1929,6 +1929,30 @@ EOP
+ fresh_perl_is('"AA" =~ m/AA{1,0}/','',{},"handle OPFAIL insert properly");
+ }
+
++ # gh16947: test regexp corruption (GOSUB)
++ {
++ fresh_perl_is(q{
++ 'xy' =~ /x(?0)|x(?|y|y)/ && print 'ok'
++ }, 'ok', {}, 'gh16947: test regexp corruption (GOSUB)');
++ }
++ # gh16947: test fix doesn't break SUSPEND
++ {
++ fresh_perl_is(q{ 'sx' =~ m{ss++}i; print 'ok' },
++ 'ok', {}, "gh16947: test fix doesn't break SUSPEND");
++ }
++
++ # gh17743: more regexp corruption via GOSUB
++ {
++ fresh_perl_is(q{
++ "0" =~ /((0(?0)|000(?|0000|0000)(?0))|)/; print "ok"
++ }, 'ok', {}, 'gh17743: test regexp corruption (1)');
++
++ fresh_perl_is(q{
++ "000000000000" =~ /(0(())(0((?0)())|000(?|\x{ef}\x{bf}\x{bd}|\x{ef}\x{bf}\x{bd}))|)/;
++ print "ok"
++ }, 'ok', {}, 'gh17743: test regexp corruption (2)');
++ }
++
+ } # End of sub run_tests
+
+ 1;
+--
+2.20.1
+
diff --git a/SOURCES/perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch b/SOURCES/perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch
new file mode 100644
index 0000000..4fb8553
--- /dev/null
+++ b/SOURCES/perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch
@@ -0,0 +1,113 @@
+From 381d51822fccaa333cbd0ab9fca8b69f650c05f9 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
+Date: Fri, 14 Feb 2020 14:10:10 +0100
+Subject: [PATCH] Only pass 2-digit years to tests when testing 2-digit year
+ handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This will start breaking in 2020 if done without working around the whole
+breakpoint thing. See https://rt.cpan.org/Ticket/Display.html?id=124787.
+
+Ported from Time-Local 63265fd81c7f6177bf28dfe0d1ada9cb897de566 commit
+by Dave Rolsky <autarch@urth.org> to perl 5.28.2.
+
+Signed-off-by: Petr Písař <ppisar@redhat.com>
+---
+ cpan/Time-Local/t/Local.t | 40 +++++++++++++++++++++++++++++----------
+ 1 file changed, 30 insertions(+), 10 deletions(-)
+
+diff --git a/cpan/Time-Local/t/Local.t b/cpan/Time-Local/t/Local.t
+index 6341396..701d22d 100644
+--- a/cpan/Time-Local/t/Local.t
++++ b/cpan/Time-Local/t/Local.t
+@@ -85,19 +85,17 @@ my $epoch_is_64
+
+ for ( @time, @neg_time ) {
+ my ( $year, $mon, $mday, $hour, $min, $sec ) = @$_;
+- $year -= 1900;
+ $mon--;
+
+ SKIP: {
+ skip '1970 test on VOS fails.', 12
+- if $^O eq 'vos' && $year == 70;
++ if $^O eq 'vos' && $year == 1970;
+ skip 'this platform does not support negative epochs.', 12
+- if $year < 70 && !$neg_epoch_ok;
++ if $year < 1970 && !$neg_epoch_ok;
+
+ # Test timelocal()
+ {
+- my $year_in = $year < 70 ? $year + 1900 : $year;
+- my $time = timelocal( $sec, $min, $hour, $mday, $mon, $year_in );
++ my $time = timelocal( $sec, $min, $hour, $mday, $mon, $year );
+
+ my ( $s, $m, $h, $D, $M, $Y ) = localtime($time);
+
+@@ -106,13 +104,12 @@ SKIP: {
+ is( $h, $hour, "timelocal hour for @$_" );
+ is( $D, $mday, "timelocal day for @$_" );
+ is( $M, $mon, "timelocal month for @$_" );
+- is( $Y, $year, "timelocal year for @$_" );
++ is( $Y, $year - 1900, "timelocal year for @$_" );
+ }
+
+ # Test timegm()
+ {
+- my $year_in = $year < 70 ? $year + 1900 : $year;
+- my $time = timegm( $sec, $min, $hour, $mday, $mon, $year_in );
++ my $time = timegm( $sec, $min, $hour, $mday, $mon, $year );
+
+ my ( $s, $m, $h, $D, $M, $Y ) = gmtime($time);
+
+@@ -121,14 +118,13 @@ SKIP: {
+ is( $h, $hour, "timegm hour for @$_" );
+ is( $D, $mday, "timegm day for @$_" );
+ is( $M, $mon, "timegm month for @$_" );
+- is( $Y, $year, "timegm year for @$_" );
++ is( $Y, $year - 1900, "timegm year for @$_" );
+ }
+ }
+ }
+
+ for (@bad_time) {
+ my ( $year, $mon, $mday, $hour, $min, $sec ) = @$_;
+- $year -= 1900;
+ $mon--;
+
+ eval { timegm( $sec, $min, $hour, $mday, $mon, $year ) };
+@@ -229,6 +225,30 @@ SKIP:
+ );
+ }
+
++# 2-digit years
++{
++ my $current_year = ( localtime() )[5];
++ my $pre_break = ( $current_year + 49 ) - 100;
++ my $break = ( $current_year + 50 ) - 100;
++ my $post_break = ( $current_year + 51 ) - 100;
++
++ is(
++ ( ( localtime( timelocal( 0, 0, 0, 1, 1, $pre_break ) ) )[5] ),
++ $pre_break + 100,
++ "year $pre_break is treated as next century",
++ );
++ is(
++ ( ( localtime( timelocal( 0, 0, 0, 1, 1, $break ) ) )[5] ),
++ $break + 100,
++ "year $break is treated as next century",
++ );
++ is(
++ ( ( localtime( timelocal( 0, 0, 0, 1, 1, $post_break ) ) )[5] ),
++ $post_break,
++ "year $post_break is treated as current century",
++ );
++}
++
+ SKIP:
+ {
+ skip 'These tests only run for the package maintainer.', 8
+--
+2.21.1
+
diff --git a/SPECS/perl.spec b/SPECS/perl.spec
index 16e6095..5804c5b 100644
--- a/SPECS/perl.spec
+++ b/SPECS/perl.spec
@@ -81,7 +81,7 @@ License: GPL+ or Artistic
Epoch: %{perl_epoch}
Version: %{perl_version}
# release number must be even higher, because dual-lived modules will be broken otherwise
-Release: 416%{?dist}
+Release: 417%{?dist}
Summary: Practical Extraction and Report Language
Url: http://www.perl.org/
Source0: http://www.cpan.org/src/5.0/perl-%{perl_version}.tar.bz2
@@ -289,6 +289,14 @@ Patch89: perl-5.26.2-perl.h-Add-parens-around-macro-arguments.patch
# Pass the correct CFLAGS to dtrace
Patch90: perl-5.26.2-Pass-CFLAGS-to-dtrace.patch
+# Fix Time-Local tests to pass after year 2019, bug #1807120, CPAN RT#124787,
+# GH#17410, in Time-Local-1.26
+Patch91: perl-5.28.2-Only-pass-2-digit-years-to-tests-when-testing-2-digi.patch
+
+# Fix CVE-2020-12723, bug #1909860, GH#16947, fixed in upstream 5.28.3, ported from
+# upstream 3f4ba871d2d397dcd4386ed75e05353c36135c29.
+Patch92: perl-5.26.3-CVE-2020-12723.patch
+
# Link XS modules to libperl.so with EU::CBuilder on Linux, bug #960048
Patch200: perl-5.16.3-Link-XS-modules-to-libperl.so-with-EU-CBuilder-on-Li.patch
@@ -2895,6 +2903,8 @@ Perl extension for Version Objects
%patch88 -p1
%patch89 -p1
%patch90 -p1
+%patch91 -p1
+%patch92 -p1
%patch200 -p1
%patch201 -p1
@@ -2952,6 +2962,8 @@ perl -x patchlevel.h \
'Fedora Patch88: Fix printing a warning about a wide character when matching a regular expression while ISO-8859-1 locale is in effect' \
'Fedora Patch89: Fix invoking a check for wide characters while ISO-8859-1 locale is in effect' \
'Fedora Patch90: Pass the correct CFLAGS to dtrace' \
+ 'RHEL Patch91: Fix Time-Local tests to pass after year 2019 (bug #1807120)' \
+ 'RHEL Patch92: Fix CVE-2020-12723 (GH#16947)' \
'Fedora Patch200: Link XS modules to libperl.so with EU::CBuilder on Linux' \
'Fedora Patch201: Link XS modules to libperl.so with EU::MM on Linux' \
%{nil}
@@ -5239,6 +5251,10 @@ popd
# Old changelog entries are preserved in CVS.
%changelog
+* Fri Dec 18 2020 Petr Pisar <ppisar@redhat.com> - 4:5.26.3-417
+- Fix CVE-2020-12723 (bug #1909860)
+- Fix Time-Local tests to pass after year 2019 (bug #1807120)
+
* Thu Dec 06 2018 Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
- 5.26.3 bump (bug #1655526)
- Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)