Fedora 20: perl-Test-Signature Security Update

    Date18 Apr 2015
    CategoryFedora
    83
    Posted ByLinuxSecurity Advisories
    This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behavior is included in this update. Security issues: * Module::Signature before version 0.75 could be tricked [More...]
    --------------------------------------------------------------------------------
    Fedora Update Notification
    FEDORA-2015-5840
    2015-04-09 04:58:27
    --------------------------------------------------------------------------------
    
    Name        : perl-Test-Signature
    Product     : Fedora 20
    Version     : 1.11
    Release     : 1.fc20
    URL         : http://search.cpan.org/dist/Test-Signature/
    Summary     : Automated SIGNATURE testing
    Description :
    Module::Signature allows you to verify that a distribution has not been
    tampered with. Test::Signature lets that be tested as part of the
    distribution's test suite.
    
    --------------------------------------------------------------------------------
    Update Information:
    
    This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behavior is included in this update.
    
    Security issues:
    
     * Module::Signature before version 0.75 could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries.
    
     * When verifying the contents of a CPAN module, Module::Signature before version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute
    automatically during "make test".
    
     * Module::Signature before version 0.75 used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell commands into the SIGNATURE file that would execute during the signature verification process.
    
     * Module::Signature before version 0.75 has been loading several modules at runtime inside the extracted module directory. Modules like Text::Diff are not guaranteed to be available on all platforms and could be added to a malicious
    module so that they would load from the '.' path in @INC.
    
    --------------------------------------------------------------------------------
    ChangeLog:
    
    * Wed Apr  8 2015 Paul Howarth  - 1.11-1
    - Update to 1.11
      - Compatibility with Module::Signature 0.75+
    - Classify buildreqs by usage
    - Don't use macros for commands
    - Avoid clobbering ~/.gnupg for local builds
    - Make %files list more explicit
    - Drop %defattr, redundant since rpm 4.4
    - Import upstream's GPG key in %prep so we don't need to fetch it from a
      keyserver when running the signature test
    * Tue Aug 26 2014 Jitka Plesnikova  - 1.10-18
    - Perl 5.20 rebuild
    * Sat Jun  7 2014 Fedora Release Engineering  - 1.10-17
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
    --------------------------------------------------------------------------------
    References:
    
      [ 1 ] Bug #1209911 - perl-Module-Signature: unsigned files interpreted as signed in some circumstances
            https://bugzilla.redhat.com/show_bug.cgi?id=1209911
      [ 2 ] Bug #1209915 - perl-Module-Signature: arbitrary code execution during test phase
            https://bugzilla.redhat.com/show_bug.cgi?id=1209915
      [ 3 ] Bug #1209917 - perl-Module-Signature: arbitrary code execution when verifying module signatures
            https://bugzilla.redhat.com/show_bug.cgi?id=1209917
      [ 4 ] Bug #1209918 - perl-Module-Signature: arbitrary modules loading in some circumstances
            https://bugzilla.redhat.com/show_bug.cgi?id=1209918
    --------------------------------------------------------------------------------
    
    This update can be installed with the "yum" update program.  Use
    su -c 'yum update perl-Test-Signature' at the command line.
    For more information, refer to "Managing Software with yum",
    available at http://docs.fedoraproject.org/yum/.
    
    All packages are signed with the Fedora Project GPG key.  More details on the
    GPG keys used by the Fedora Project can be found at
    https://fedoraproject.org/keys
    --------------------------------------------------------------------------------
    _______________________________________________
    package-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://admin.fedoraproject.org/mailman/listinfo/package-announce
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"24","type":"x","order":"1","pct":54.55,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":11.36,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"15","type":"x","order":"3","pct":34.09,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.