Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Fedora 20: Security Advisory - perl-Test-Signature Critical Issues

fedora
Calendar Grey April 18, 2015
Dist Fedora Esm H88
Improving security in perl-Test-Signature involves assessing signature verification mechanisms, upgrading cryptographic standards, and enhancing error handling protocols to detect threats.
This update addresses various security issues in perl-Module-Signature as described below

Summary

Module::Signature allows you to verify that a distribution has not been

tampered with. Test::Signature lets that be tested as part of the

distribution's test suite.

Update Information:

This update addresses various security issues in perl-Module-Signature as described below. The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a "skip" parameter is specified. An updated version of perl-Test-Signature that accounts for the changed default behavior is included in this update.

Security issues:

* Module::Signature before version 0.75 could be tricked into interpreting the unsigned portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP signature boundaries.

* When verifying the contents of a CPAN module, Module::Signature before version 0.75 ignored some files in the extracted tarball that were not listed in the signature file. This included some files in the t/ directory that would execute automatically during "make test".

* Module::Signature before version 0.75 used two argument open() calls to read the files when generating checksums from the signed manifest. This allowed embedding arbitrary shell co...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory Fedora security issues signature checking perl-Test-Signature

Change Log

* Wed Apr 8 2015 Paul Howarth - 1.11-1 - Update to 1.11 - Compatibility with Module::Signature 0.75+ - Classify buildreqs by usage - Don't use macros for commands - Avoid clobbering ~/.gnupg for local builds - Make %files list more explicit - Drop %defattr, redundant since rpm 4.4 - Import upstream's GPG key in %prep so we don't need to fetch it from a keyserver when running the signature test * Tue Aug 26 2014 Jitka Plesnikova - 1.10-18 - Perl 5.20 rebuild * Sat Jun 7 2014 Fedora Release Engineering - 1.10-17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

References


[ 1 ] Bug #1209911 - perl-Module-Signature: unsigned files interpreted as signed in some circumstances https://bugzilla.redhat.com/show_bug.cgi?id=1209911 [ 2 ] Bug #1209915 - perl-Module-Signature: arbitrary code execution during test phase https://bugzilla.redhat.com/show_bug.cgi?id=1209915 [ 3 ] Bug #1209917 - perl-Module-Signature: arbitrary code execution when verifying module signatures https://bugzilla.redhat.com/show_bug.cgi?id=1209917 [ 4 ] Bug #1209918 - perl-Module-Signature: arbitrary modules loading in some circumstances https://bugzilla.redhat.com/show_bug.cgi?id=1209918

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update perl-Test-Signature' at the command line. For more information, refer to "Managing Software with yum", available at .

Severity
critical
Lowest
Low
Medium
High
Critical

Name: perl-Test-Signature
Product: Fedora 20
Version: 1.11
Release: 1.fc20
URL: https://metacpan.org/dist/Test-Signature
Summary: Automated SIGNATURE testing

Topics%20covered

Topics Covered

security advisory Fedora security issues signature checking perl-Test-Signature

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here