Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Mehrere Probleme in perl-Module-Signature
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in perl-Module-Signature
ID: FEDORA-2015-5904
Distribution: Fedora
Plattformen: Fedora 22
Datum: Di, 21. April 2015, 23:28
Referenzen: Keine Angabe

Originalnachricht

Name        : perl-Module-Signature
Product : Fedora 22
Version : 0.78
Release : 1.fc22
URL : http://search.cpan.org/dist/Module-Signature/
Summary : CPAN signature management utilities and modules
Description :
This package contains a command line tool and module for checking and creating
SIGNATURE files for Perl CPAN distributions.

-------------------------------------------------------------------------------
-
Update Information:

This update addresses various security issues in perl-Module-Signature as
described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behaviour is included in this update.

Security issues:

* Module::Signature before version 0.75 could be tricked into interpreting the
unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries.

* When verifying the contents of a CPAN module, Module::Signature before
version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute
automatically during "make test".

* Module::Signature before version 0.75 used two argument open() calls to read
the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process.

* Module::Signature before version 0.75 has been loading several modules at
runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious
module so that they would load from the '.' path in @INC.

-------------------------------------------------------------------------------
-
References:

[ 1 ] Bug #1209911 - perl-Module-Signature: unsigned files interpreted as
signed in some circumstances
https://bugzilla.redhat.com/show_bug.cgi?id=1209911
[ 2 ] Bug #1209915 - perl-Module-Signature: arbitrary code execution during
test phase
https://bugzilla.redhat.com/show_bug.cgi?id=1209915
[ 3 ] Bug #1209917 - perl-Module-Signature: arbitrary code execution when
verifying module signatures
https://bugzilla.redhat.com/show_bug.cgi?id=1209917
[ 4 ] Bug #1209918 - perl-Module-Signature: arbitrary modules loading in some
circumstances
https://bugzilla.redhat.com/show_bug.cgi?id=1209918
-------------------------------------------------------------------------------
-

This update can be installed with the "yum" update program. Use
su -c 'yum update perl-Module-Signature' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
-------------------------------------------------------------------------------
-
_______________________________________________
package-announce mailing list
package-announce@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung