diff options
| author | root <root@rshg054.dnsready.net> | 2012-01-19 23:15:04 +0000 |
|---|---|---|
| committer | root <root@rshg054.dnsready.net> | 2012-01-19 23:15:04 +0000 |
| commit | eefecc8813e0c062a2058b33209cb30830f824b6 (patch) | |
| tree | f2dd237a65b4a8a3587da4cb6ac211ae6048911f /testing/perl | |
| parent | 3e2075427791725d8e6a007feba107d94c017caf (diff) | |
Thu Jan 19 23:15:03 UTC 2012
Diffstat (limited to 'testing/perl')
| -rw-r--r-- | testing/perl/PKGBUILD | 8 | ||||
| -rw-r--r-- | testing/perl/digest_eval_hole.diff | 61 |
2 files changed, 67 insertions, 2 deletions
diff --git a/testing/perl/PKGBUILD b/testing/perl/PKGBUILD index e3bd0f0c4..73d4715af 100644 --- a/testing/perl/PKGBUILD +++ b/testing/perl/PKGBUILD @@ -1,11 +1,11 @@ -# $Id: PKGBUILD 146353 2012-01-09 18:52:56Z stephane $ +# $Id: PKGBUILD 146806 2012-01-18 17:06:31Z bluewind $ # Maintainer: Angel Velasquez <angvp@archlinux.org> # Contributor: kevin <kevin.archlinux.org> # Contributor: judd <jvinet.zeroflux.org> # Contributor: francois <francois.archlinux.org> pkgname=perl pkgver=5.14.2 -pkgrel=6 +pkgrel=7 pkgdesc="A highly capable, feature-rich programming language" arch=(i686 x86_64) license=('GPL' 'PerlArtistic') @@ -17,6 +17,7 @@ source=(http://www.cpan.org/src/5.0/perl-${pkgver}.tar.bz2 perlbin.sh perlbin.csh provides.pl +digest_eval_hole.diff 0001-Append-CFLAGS-and-LDFLAGS-to-their-Config.pm-counter.patch) install=perl.install options=('makeflags' '!purge') @@ -24,6 +25,7 @@ md5sums=('04a4c5d3c1f9f19d77daff8e8cd19a26' '5ed2542fdb9a60682f215bd33701e61a' '1f0cbbee783e8a6d32f01be5118e0d5e' '31fc0b5bb4935414394c5cfbec2cb8e5' + '490852b3d77c3b3866d0d75f5fbf5c5d' 'c25d86206d649046538c3daab7874564') build() { @@ -37,6 +39,8 @@ build() { arch_opts="" fi + patch -Np1 -i $srcdir/digest_eval_hole.diff + ./Configure -des -Dusethreads -Duseshrplib -Doptimize="${CFLAGS}" \ -Dprefix=/usr -Dinstallprefix=${pkgdir}/usr -Dvendorprefix=/usr \ -Dprivlib=/usr/share/perl5/core_perl \ diff --git a/testing/perl/digest_eval_hole.diff b/testing/perl/digest_eval_hole.diff new file mode 100644 index 000000000..47904137b --- /dev/null +++ b/testing/perl/digest_eval_hole.diff @@ -0,0 +1,61 @@ +From 4b6a7324284e7435a361c58f7ddb32fc0c635bd0 Mon Sep 17 00:00:00 2001 +From: "Michael G. Schwern" <schwern@pobox.com> +Date: Mon, 3 Oct 2011 19:05:29 +0100 +Subject: Close the eval "require $module" security hole in + Digest->new($algorithm) + +Also the filter was incomplete. + +Bug-Debian: http://bugs.debian.org/644108 + +Patch-Name: fixes/digest_eval_hole.diff +--- + cpan/Digest/Digest.pm | 6 ++++-- + cpan/Digest/t/security.t | 14 ++++++++++++++ + 2 files changed, 18 insertions(+), 2 deletions(-) + create mode 100644 cpan/Digest/t/security.t + +diff --git a/cpan/Digest/Digest.pm b/cpan/Digest/Digest.pm +index 384dfc8..d714434 100644 +--- a/cpan/Digest/Digest.pm ++++ b/cpan/Digest/Digest.pm +@@ -24,7 +24,7 @@ sub new + shift; # class ignored + my $algorithm = shift; + my $impl = $MMAP{$algorithm} || do { +- $algorithm =~ s/\W+//; ++ $algorithm =~ s/\W+//g; + "Digest::$algorithm"; + }; + $impl = [$impl] unless ref($impl); +@@ -35,7 +35,9 @@ sub new + ($class, @args) = @$class if ref($class); + no strict 'refs'; + unless (exists ${"$class\::"}{"VERSION"}) { +- eval "require $class"; ++ my $pm_file = $class . ".pm"; ++ $pm_file =~ s{::}{/}g; ++ eval { require $pm_file }; + if ($@) { + $err ||= $@; + next; +diff --git a/cpan/Digest/t/security.t b/cpan/Digest/t/security.t +new file mode 100644 +index 0000000..5cba122 +--- /dev/null ++++ b/cpan/Digest/t/security.t +@@ -0,0 +1,14 @@ ++#!/usr/bin/env perl ++ ++# Digest->new() had an exploitable eval ++ ++use strict; ++use warnings; ++ ++use Test::More tests => 1; ++ ++use Digest; ++ ++$LOL::PWNED = 0; ++eval { Digest->new(q[MD;5;$LOL::PWNED = 42]) }; ++is $LOL::PWNED, 0; |