Your message dated Mon, 21 Apr 2014 21:22:33 +0000
with message-id <[email protected]>
and subject line Bug#745427: fixed in libdbi-perl 1.631-3
has caused the Debian Bug report #745427,
regarding libdbi-perl: Suggests libplrpc-perl which should be removed from the
archive
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
745427: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=745427
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libdbi-perl
Severity: important
Hi Debian Perl Group members :)
libplrpc-perl should be removed from the archive[1] as it uses
Storable in an unsafe way, leading to a remote code execution
vulnerability (in both the client and the server).[2,3].
Petr from Red Hat also asked to add a security notice for the proxy
drivers[4], but this code is unmaintained in DBI[5].
libdbi-perl is the only consumer of libplrpc-perl via Suggests, so I
propose to drop the Suggests and maybe add a NEWS.Debian mentioning
the removal. Do anybody have otherwise another better aproach?
[1] https://bugs.debian.org/734789
[2] https://rt.cpan.org/Public/Bug/Display.html?id=90474
[3] https://bugzilla.redhat.com/show_bug.cgi?id=1030572
[4] https://rt.cpan.org/Public/Bug/Display.html?id=90475
[5] https://rt.cpan.org/Public/Bug/Display.html?id=61976#txn-840757
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libdbi-perl
Source-Version: 1.631-3
We believe that the bug you reported is fixed in the latest version of
libdbi-perl, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Damyan Ivanov <[email protected]> (supplier of updated libdbi-perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Mon, 21 Apr 2014 23:31:19 +0300
Source: libdbi-perl
Binary: libdbi-perl
Architecture: source amd64
Version: 1.631-3
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: Damyan Ivanov <[email protected]>
Description:
libdbi-perl - Perl Database Interface (DBI)
Closes: 745427
Changes:
libdbi-perl (1.631-3) unstable; urgency=medium
.
* Remove libplrpc-perl from Suggests:
(Closes: #745427 -- Suggests libplrpc-perl which should be removed from
the archive)
* warn users of DBI::Proxy about its unsafe usage of Storable
patch by Petr Písař from
https://rt.cpan.org/Public/Bug/Display.html?id=90475
Checksums-Sha1:
c4cc63abe95fca8b5fc390c90c932f2a274fc4d8 2264 libdbi-perl_1.631-3.dsc
87108cc006c1c2081d8558866361b1a5ff313d42 12292
libdbi-perl_1.631-3.debian.tar.xz
1a8e4d3c1a6b6fc5b7a210facdbf3eb36f88abd2 814712 libdbi-perl_1.631-3_amd64.deb
Checksums-Sha256:
1e91b15da1278bd16d40484f5264210ac8100c08b9ed1cb1eec230141f9d471b 2264
libdbi-perl_1.631-3.dsc
a18518f27ac5e17c2376beec1efff6b69aa44bdf6d369171b0083977848a4229 12292
libdbi-perl_1.631-3.debian.tar.xz
898af87706c316f9499f4ce082f461fa561287863415f3c2e9cdfcbe9a72e637 814712
libdbi-perl_1.631-3_amd64.deb
Files:
22faa2a3e8c046873e73f4d098c04e66 2264 perl optional libdbi-perl_1.631-3.dsc
4e6df55b91f37cfa08d7e6df0339e9ed 12292 perl optional
libdbi-perl_1.631-3.debian.tar.xz
e0be20eba170c8643709dd2984b4f52f 814712 perl optional
libdbi-perl_1.631-3_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCAAGBQJTVYCUAAoJENu+nU2Z0qAEZwwP/1cx8fwkXcNCWtqcLYm6WJ41
wipr+CuvBRRxLNyIvsh2dTXT95uB3Z7VORahwyIHuQorRej3h6nvm7LPEtstv9RH
m2vrHQF5aYC7r8qn0YAl8KdjCZFySk3OeX/2tIi/vMTKC0C+ozGAfDypx64NtUde
FSkx00MpLZNj3o/Tp5/U5XtVG7CnXa1VNj5IGsxjPkCsjeWsRZjpLKeqF7fSoFcx
A9QgKMb3LjyEUWE0s/gfVvsAN5hlmlX2rM/Gs4puryG/tdsr15OwD5qXnNCnKYKv
hR47opS7Ox0I0eriAcSoT7M3XFgipExvf58ul3BgZojnODX6SjkAELo40sZxaFrC
aWTUOaFNM8akrtZup8bKuaYFXwfvaWSqnRgluYFwiuEz7O/XNUQ4QFp+CkkhdfcC
CLn3OLwADWQMqfyBCYhDjQptoN/9ZSMXT0+FX9QjLuOIn/Nd3H89xAo/Ms6ajXl3
8ehAXdKSFgXurZQsbcvy6VEekY+C8zC1kjEMjuB+0QGv8JYUzOJyOky2N4o4Erae
FZ1uh7sivcnUpzCFmVu53bbgYOCzEHufG5qJGQFAgJ+enH8q29nJDYxyxQqdQvny
H4QYPxtbk6rJkcEhKVXeyYL7GA8mK9itrr00US4kIsQyoqNJrw1SPzPzINS4bKug
AjG+t3eUSXuej8YDdnmD
=zCcQ
-----END PGP SIGNATURE-----
--- End Message ---
