This is an automated email from the git hooks/post-receive script. jamessan pushed a commit to branch master in repository devscripts.
commit 4b7e58ee6000cdefac0682601cec6ecce0137467 Author: James McCoy <[email protected]> Date: Wed Dec 18 22:09:55 2013 -0500 uscan: Follow tar's recommended security practices Signed-off-by: James McCoy <[email protected]> --- debian/changelog | 4 ++++ scripts/uscan.pl | 12 +++++++++--- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/debian/changelog b/debian/changelog index d5805a3..b08d913 100644 --- a/debian/changelog +++ b/debian/changelog @@ -10,6 +10,10 @@ devscripts (2.13.9) UNRELEASED; urgency=low allowing arbitrary code execution. Fixes CVE-2013-6888. + Use find's -exec to call rm directly instead of piping to xargs. (Closes: #732006, CVE-2013-7085) + + Follow tar's recommended security practices + - Use --keep-old-files --no-overwrite-dir + - Ensure parent directory of directory used for repacking archive isn't + accessible to other users. -- Martin Pitt <[email protected]> Thu, 12 Dec 2013 11:08:27 +0100 diff --git a/scripts/uscan.pl b/scripts/uscan.pl index 953783c..a8cc7ad 100755 --- a/scripts/uscan.pl +++ b/scripts/uscan.pl @@ -1466,7 +1466,10 @@ EOF or uscan_die("unzip binary not found. You need to install the package unzip to be able to repack .zip upstream archives.\n"); my $newfile_base_gz = "$1.tar.gz"; - my $tempdir = tempdir ( "uscanXXXX", TMPDIR => 1, CLEANUP => 1 ); + my $tempdir = tempdir ("uscanXXXX", TMPDIR => 1, CLEANUP => 1); + # Parent of the target directory should be under our control + $tempdir .= '/repack'; + mkdir $tempdir or uscan_die("Unable to mkdir($tempdir): $!\n"); my $absdestdir = abs_path($destdir); system('unzip', '-q', '-a', '-d', $tempdir, "$destdir/$newfile_base") == 0 or uscan_die("Repacking from zip or jar to tar.gz failed (could not unzip)\n"); @@ -1512,10 +1515,13 @@ EOF undef $data; }; if ($data && $data->{'format'} =~ m{^$okformat/?$} && $data->{'files-excluded'} ) { - my $tempdir = tempdir ( "uscanXXXX", TMPDIR => 1, CLEANUP => 1 ); + my $tempdir = tempdir ("uscanXXXX", TMPDIR => 1, CLEANUP => 1); + # Parent of the target directory should be under our control + $tempdir .= '/repack'; + mkdir $tempdir or uscan_die("Unable to mkdir($tempdir): $!\n"); my $absdestdir = abs_path($destdir); eval { - spawn(exec => ['tar', '-xa', '-C', $tempdir, '-f', "$absdestdir/$newfile_base"], + spawn(exec => ['tar', '-xa', '-k', '--no-overwrite-dir', '-C', $tempdir, '-f', "$absdestdir/$newfile_base"], wait_child => 1); }; if ($@) { -- Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/collab-maint/devscripts.git _______________________________________________ devscripts-devel mailing list [email protected] http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/devscripts-devel
