The following commit has been merged in the master branch:
commit 0fd15bdec07b085f9ef438dacd18e159ac60b810
Author: Adam D. Barratt <[email protected]>
Date: Fri Sep 14 12:37:26 2012 -0500
dget: fix arbitrary file deletion (CVE-2012-2241)
Reviewed-by: Raphael Geissert <[email protected]>
Signed-off-by: Raphael Geissert <[email protected]>
Signed-off-by: James McCoy <[email protected]>
diff --git a/scripts/dget.pl b/scripts/dget.pl
index 2ed2d36..f6e7706 100755
--- a/scripts/dget.pl
+++ b/scripts/dget.pl
@@ -238,7 +238,10 @@ sub parse_file {
open $fh, $file or die "$file: $!";
while (<$fh>) {
if (/^ ([0-9a-f]{32}) (?:\S+ )*(\S+)$/) {
- get_file($dir, $2, $1) or return;
+ my ($_sum, $_file) = ($1, $2);
+ $_file !~ m,[/\x00],
+ or die "File name contains invalid characters: $_file";
+ get_file($dir, $_file, $_sum) or return;
}
}
close $fh;
--
Git repository for devscripts
_______________________________________________
devscripts-devel mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/devscripts-devel
