This is an automated email from the git hooks/post-receive script. carnil pushed a commit to branch wheezy in repository libmodule-signature-perl.
commit e3c39dc38b37d675a9d00a07dd5d7a1fc727e71c Author: Salvatore Bonaccorso <car...@debian.org> Date: Tue May 12 22:44:48 2015 +0200 Add CVE-2015-3409.patch patch CVE-2015-3409: Module::Signature incorrectly handles module loading allowing to load modules from relative paths in @INC. A remote attacker providing a malicious module could use this issue to execute arbitrary code during signature verification. Closes: #783451 --- debian/patches/CVE-2015-3409.patch | 24 ++++++++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 25 insertions(+) diff --git a/debian/patches/CVE-2015-3409.patch b/debian/patches/CVE-2015-3409.patch new file mode 100644 index 0000000..e0ccb7b --- /dev/null +++ b/debian/patches/CVE-2015-3409.patch @@ -0,0 +1,24 @@ +Description: Fix CVE-2015-3409 + CVE-2015-3409: Module::Signature incorrectly handles module loading + allowing to load modules from relative paths in @INC. A remote attacker + providing a malicious module could use this issue to execute arbitrary + code during signature verification. +Origin: upstream, https://github.com/audreyt/module-signature/commit/c41e8885b862b9fce2719449bc9336f0bea658ef +Bug-Debian: https://bugs.debian.org/783451 +Forwarded: not-needed +Author: Audrey Tang <audr...@audreyt.org> +Reviewed-by: Salvatore Bonaccorso <car...@debian.org> +Last-Update: 2015-05-12 +Applied-Upstream: 0.75 + +--- a/lib/Module/Signature.pm ++++ b/lib/Module/Signature.pm +@@ -118,6 +118,8 @@ sub _verify { + my $sigtext = shift || ''; + my $plaintext = shift || ''; + ++ # Avoid loading modules from relative paths in @INC. ++ local @INC = grep { File::Spec->file_name_is_absolute($_) } @INC; + local $SIGNATURE = $signature if $signature ne $SIGNATURE; + + if ($AutoKeyRetrieve and !$CanKeyRetrieve) { diff --git a/debian/patches/series b/debian/patches/series index 2b511c0..d2c2a5b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -1,2 +1,3 @@ CVE-2013-2145.patch CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch +CVE-2015-3409.patch -- Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-perl/packages/libmodule-signature-perl.git _______________________________________________ Pkg-perl-cvs-commits mailing list Pkg-perl-cvs-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-perl-cvs-commits