CVE-2013-1437 Vulnerability in Module::Metadata #13115
Comments
From @jmdhHello Module::Metadata upstream (CC perl5-security-report as this is Please see below a security vulnerability reported to the Debian I would be grateful if you could confirm that you have received this The additional public bug report which alludes to the issue is Thanks, ----- Forwarded message from Salvatore Bonaccorso <carnil@debian.org> ----- Date: Thu, 18 Jul 2013 07:48:25 +0200 Hi Brian [Adding the Perl maintainers Niko and Dominic for perl, and Gregor for This is only a first 'ping' to confirm your mail arrived. On Thu, Jul 18, 2013 at 02:06:49AM +0000, brian m. carlson wrote:
Thanks for your report. Can confirm, indeed from a first look it So, despite description says so, it still can evaluate code which the Before assigning a CVE, Dominic, Niko: As Module::Metadata is also in Thanks and regards, ----- End forwarded message ----- |
From @jmdhPlease reply including the new subject line [perl #118955] which On Sat, Jul 20, 2013 at 02:12:14PM +0100, Dominic Hargreaves wrote:
|
From @LeontOn Sat, Jul 20, 2013 at 3:15 PM, Dominic Hargreaves <dom@earth.li> wrote:
I'd say this is a serious documentation bug. It's working exactly as intended. I wish we could change it (for Leon |
|
The RT System itself - Status changed from 'new' to 'open' |
From @LeontOn Sun, Jul 21, 2013 at 10:03 PM, brian m. carlson
I agree that's most unfortunate. That doesn't give us a free pass out
I would question that wisdom too, but that is a mistake made back in I suspect the way out would be to emulate that: evaluate it in a Safe
This module wasn't initially written for use-cases where security
Any fix should not break distributions using Module::Build, or any Leon |
From sandals@crustytoothpaste.netOn Sun, Jul 21, 2013 at 05:11:43PM +0200, Leon Timmermans wrote:
Unfortunately, the problem with making this a documentation bug is that As well, I must question the wisdom of eval'ing any sort of data from I discovered this bug because simply doing a "use RDF::Trine" in taint -- |
From @rjbs* Leon Timmermans <fawaka@gmail.com> [2013-07-21T11:11:43]
This is my feeling as well. A safe (but less useful) version should be I can inform vendors of this problem with an embargo, followed by a fixed If anybody has a better idea, the time to speak up is now. -- |
From carnil@debian.orgHi Ricardo, On Wed, Jul 24, 2013 at 12:46:47AM -0400, Ricardo Signes wrote:
Yes this should be fine, thank you for the followups. Regards, |
From sandals@crustytoothpaste.netOn Wed, Jul 24, 2013 at 12:46:47AM -0400, Ricardo Signes wrote:
As I said, since people are probably relying on the documented behavior,
The module can be patched to check for valid $VERSION values and accept -- |
From @tonycozOn Wed, Jul 24, 2013 at 10:57:44PM +0000, brian m. carlson wrote:
Here's a few different CPAN $VERSION initializations: our $VERSION = sprintf "%d.%03d", q$Revision: 3.2 $ =~ /(\d+)\.(\d+)/g; our $VERSION = do { my @r = (q$Revision: 175 $ =~ /\d+/g); sprintf "%d."."%03d" x $#r, @r }; $VERSION=(0+sprintf('%u.%03u',(q$Id: XAO.pm,v 2.1 2005/01/14 01:39:56 am Exp $ =~ /\s(\d+)\.(\d+)\s/))) || die "Bad VERSION"; our $VERSION = do { my ($v) = (q$Revision: 687 $ =~ /\d+/mxsg); $v; }; and many more. See: http://grep.cpan.me/?q=\%24VERSION\s*%3D\s*[^'"\d.\s] file%3A\.pm%24 for more. Most appear to use simple initialization with a string or number Tony |
From sandals@crustytoothpaste.netOn Thu, Jul 25, 2013 at 10:02:52AM +1000, Tony Cook wrote:
I think these are a good argument against CVS and SVN, if nothing else, Anyway, if the concern is that Module::Build will break, why not fix the For example: # Secure by default. -- |
From @LeontOn Thu, Jul 25, 2013 at 12:57 AM, brian m. carlson
You're missing a point here. Getting a version is inherently a That may suck for people who depended on Module::Metadata being safe Leon |
From @LeontOn Thu, Jul 25, 2013 at 2:21 AM, brian m. carlson
Except that it will now break if someone upgrades Module::Metadata Leon |
From sandals@crustytoothpaste.netOn Thu, Jul 25, 2013 at 02:31:25AM +0200, Leon Timmermans wrote:
You can use a well-placed conditional die if Module::Metadata is called I understand that there aren't any great alternatives. But you -- |
From @LeontOn Thu, Jul 25, 2013 at 2:59 AM, brian m. carlson
Could you please get off your high horse? If you want to convince us Leon |
From sandals@crustytoothpaste.netOn Thu, Jul 25, 2013 at 03:46:40AM +0200, Leon Timmermans wrote:
I've made an argument. You seem unconvinced. So let's cut to the -- |
From @rjbs* Ricardo Signes <perl.security@rjbs.manxome.org> [2013-07-24T00:46:47]
This is how we will be proceeding. I am at a conference this week, and am -- |
From sandals@crustytoothpaste.netI should apologize for my behavior last night. I went beyond zealous Again, my apologies. -- -- |
From @rjbs* Ricardo Signes <perl.security@rjbs.manxome.org> [2013-07-24T00:46:47]
I spent a bit of time looking into this tonight. The way the library is -- |
From @rjbs* Ricardo Signes <perl.security@rjbs.manxome.org> [2013-07-29T22:53:12]
The impression I am getting is that this is only going to get fixed by https://github.com/dagolden/Module-Metadata/commit/6290f67c I will inform downstream of the documentation error, with a short notice -- |
From @rjbs* Ricardo Signes <perl.security@rjbs.manxome.org> [2013-08-06T22:24:26]
I will send a public pull request or patch to Module-Metadata on August 19th, -- |
From @tonycozOn Sun Aug 11 19:07:18 2013, perl.security@rjbs.manxome.org wrote:
This changed was published in Module-Metadata 1.000015 in August last year - should this ticket be made public now? Tony |
|
@tonycoz - Status changed from 'open' to 'resolved' |
From @tonycozOn Mon Jul 14 22:37:18 2014, tonyc wrote:
Now public. Tony |
Migrated from rt.perl.org#118955 (status was 'resolved')
Searchable as RT118955$
The text was updated successfully, but these errors were encountered: