This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behavior is included in this update.

Security issues:

  • Module::Signature before version 0.75 could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries.

  • When verifying the contents of a CPAN module, Module::Signature before version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during "make test".

  • Module::Signature before version 0.75 used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process.

  • Module::Signature before version 0.75 has been loading several modules at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious module so that they would load from the '.' path in @INC.

This update has been submitted for testing by pghmcfc.

7 years ago

pghmcfc has edited this update. New build(s): perl-Module-Signature-0.78-1.el5. Removed build(s): perl-Module-Signature-0.77-1.el5.

7 years ago

This update is currently being pushed to the Fedora EPEL 5 testing updates repository.

7 years ago

This update has been pushed to testing

7 years ago

This update has reached 14 days in testing and can be pushed to stable now if the maintainer wishes

7 years ago

This update has been submitted for stable by pghmcfc.

7 years ago

This update is currently being pushed to the Fedora EPEL 5 stable updates repository.

7 years ago

This update has been pushed to stable

7 years ago

Please login to add feedback.

Metadata
Type
security
Karma
0
Signed
Content Type
RPM
Test Gating
Settings
Unstable by Karma
-3
Stable by Karma
disabled
Stable by Time
disabled
Dates
submitted
7 years ago
in testing
7 years ago
in stable
7 years ago
modified
7 years ago
BZ#965126 License metadata do not reflect cpansign license
0
0
BZ#1209911 CVE-2015-3406 perl-Module-Signature: unsigned files interpreted as signed in some circumstances
0
0
BZ#1209915 CVE-2015-3407 perl-Module-Signature: arbitrary code execution during test phase
0
0
BZ#1209917 CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures
0
0
BZ#1209918 CVE-2015-3409 perl-Module-Signature: arbitrary modules loading in some circumstances
0
0
BZ#1209922 perl-Module-Signature: various flaws [epel-all]
0
0

Automated Test Results