[libmodule-signature-perl] 01/04: Add CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch patch
Salvatore Bonaccorso
carnil at debian.org
Thu May 14 13:29:50 UTC 2015
This is an automated email from the git hooks/post-receive script.
carnil pushed a commit to annotated tag debian/0.73-1+deb8u1
in repository libmodule-signature-perl.
commit 173deb96b1cb7e542b21f686de22a77184c83b4a
Author: Salvatore Bonaccorso <carnil at debian.org>
Date: Tue May 12 22:10:02 2015 +0200
Add CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch patch
CVE-2015-3406: Module::Signature parses the unsigned portion of the
SIGNATURE file as the signed portion due to incorrect handling of PGP
signature boundaries.
CVE-2015-3407: Module::Signature incorrectly handles files that are not
listed in the SIGNATURE file. This includes some files in the t/
directory that would execute when tests are run.
CVE-2015-3408: Module::Signature uses two argument open() calls to read
the files when generating checksums from the signed manifest, allowing
to embed arbitrary shell commands into the SIGNATURE file that would
execute during the signature verification process.
Closes: #783451
---
...CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch | 174 +++++++++++++++++++++
debian/patches/series | 1 +
2 files changed, 175 insertions(+)
diff --git a/debian/patches/CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch b/debian/patches/CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch
new file mode 100644
index 0000000..e9b580c
--- /dev/null
+++ b/debian/patches/CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch
@@ -0,0 +1,174 @@
+Description: Fix CVE-2015-3406, CVE-2015-3407 and CVE-2015-3408
+ CVE-2015-3406: Module::Signature parses the unsigned portion of the
+ SIGNATURE file as the signed portion due to incorrect handling of PGP
+ signature boundaries.
+ .
+ CVE-2015-3407: Module::Signature incorrectly handles files that are not
+ listed in the SIGNATURE file. This includes some files in the t/
+ directory that would execute when tests are run.
+ .
+ CVE-2015-3408: Module::Signature uses two argument open() calls to read
+ the files when generating checksums from the signed manifest, allowing
+ to embed arbitrary shell commands into the SIGNATURE file that would
+ execute during the signature verification process.
+Origin: upstream, https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
+Bug-Debian: https://bugs.debian.org/783451
+Forwarded: not-needed
+Author: Audrey Tang <audreyt at audreyt.org>
+Reviewed-by: Salvatore Bonaccorso <carnil at debian.org>
+Last-Update: 2015-05-12
+Applied-Upstream: 0.75
+
+--- a/Makefile.PL
++++ b/Makefile.PL
+@@ -10,6 +10,7 @@ readme_from 'lib/Module/Signature.pm
+ repository 'http://github.com/audreyt/module-signature';
+ install_script 'script/cpansign';
+ build_requires 'Test::More', 0, 'IPC::Run', 0;
++requires 'File::Temp';
+
+ # On Win32 (excluding cygwin) we know that IO::Socket::INET,
+ # which is needed for keyserver stuff, doesn't work. In fact
+--- a/lib/Module/Signature.pm
++++ b/lib/Module/Signature.pm
+@@ -57,6 +57,8 @@ sub _cipher_map {
+ my @lines = split /\015?\012/, $sigtext;
+ my %map;
+ for my $line (@lines) {
++ last if $line eq '-----BEGIN PGP SIGNATURE-----';
++ next if $line =~ /^---/ .. $line eq '';
+ my($cipher,$digest,$file) = split " ", $line, 3;
+ return unless defined $file;
+ $map{$file} = [$cipher, $digest];
+@@ -65,7 +67,7 @@ sub _cipher_map {
+ }
+
+ sub verify {
+- my %args = ( skip => 1, @_ );
++ my %args = ( @_ );
+ my $rv;
+
+ (-r $SIGNATURE) or do {
+@@ -178,6 +180,11 @@ sub _fullcheck {
+ ($mani, $file) = ExtUtils::Manifest::fullcheck();
+ }
+ else {
++ my $_maniskip = &ExtUtils::Manifest::maniskip;
++ local *ExtUtils::Manifest::maniskip = sub { sub {
++ return unless $skip;
++ return $_maniskip->(@_);
++ } };
+ ($mani, $file) = ExtUtils::Manifest::fullcheck();
+ }
+
+@@ -237,6 +244,11 @@ sub _verify_gpg {
+
+ my $keyserver = _keyserver($version);
+
++ require File::Temp;
++ my $fh = File::Temp->new();
++ print $fh $sigtext;
++ close $fh;
++
+ my $gpg = _which_gpg();
+ my @quiet = $Verbose ? () : qw(-q --logger-fd=1);
+ my @cmd = (
+@@ -245,7 +257,7 @@ sub _verify_gpg {
+ ($AutoKeyRetrieve and $version ge '1.0.7')
+ ? '--keyserver-options=auto-key-retrieve'
+ : ()
+- ) : ()), $SIGNATURE
++ ) : ()), $fh->filename
+ );
+
+ my $output = '';
+@@ -257,6 +269,7 @@ sub _verify_gpg {
+ my $cmd = join ' ', @cmd;
+ $output = `$cmd`;
+ }
++ unlink $fh->filename;
+
+ if( $? ) {
+ print STDERR $output;
+@@ -285,7 +298,7 @@ sub _verify_crypt_openpgp {
+ my $pgp = Crypt::OpenPGP->new(
+ ($KeyServer) ? ( KeyServer => $KeyServer, AutoKeyRetrieve => $AutoKeyRetrieve ) : (),
+ );
+- my $rv = $pgp->handle( Filename => $SIGNATURE )
++ my $rv = $pgp->handle( Data => $sigtext )
+ or die $pgp->errstr;
+
+ return SIGNATURE_BAD if (!$rv->{Validity} and $AutoKeyRetrieve);
+@@ -308,32 +321,35 @@ sub _read_sigfile {
+ my $well_formed;
+
+ local *D;
+- open D, $sigfile or die "Could not open $sigfile: $!";
++ open D, "< $sigfile" or die "Could not open $sigfile: $!";
+
+ if ($] >= 5.006 and <D> =~ /\r/) {
+ close D;
+- open D, $sigfile or die "Could not open $sigfile: $!";
++ open D, '<', $sigfile or die "Could not open $sigfile: $!";
+ binmode D, ':crlf';
+ } else {
+ close D;
+- open D, $sigfile or die "Could not open $sigfile: $!";
++ open D, "< $sigfile" or die "Could not open $sigfile: $!";
+ }
+
++ my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
++ my $end = "-----END PGP SIGNATURE-----\n";
+ while (<D>) {
+- next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
+- last if /^-----BEGIN PGP SIGNATURE/;
+-
++ next if (1 .. ($_ eq $begin));
+ $signature .= $_;
++ return "$begin$signature" if $_ eq $end;
+ }
+
+- return ((split(/\n+/, $signature, 2))[1]);
++ return;
+ }
+
+ sub _compare {
+ my ($str1, $str2, $ok) = @_;
+
+ # normalize all linebreaks
++ $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
+ $str1 =~ s/[^\S ]+/\n/g; $str2 =~ s/[^\S ]+/\n/g;
++ $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
+
+ return $ok if $str1 eq $str2;
+
+@@ -344,7 +360,7 @@ sub _compare {
+ }
+ else {
+ local (*D, *S);
+- open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
++ open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
+ open D, "| diff -u $SIGNATURE -" or (warn "Could not call diff: $!", return SIGNATURE_MISMATCH);
+ while (<S>) {
+ print D $_ if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
+@@ -409,9 +425,9 @@ sub _sign_gpg {
+ die "Cannot find $sigfile.tmp, signing aborted.\n";
+ };
+
+- open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
++ open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
+
+- open S, ">$sigfile" or do {
++ open S, "> $sigfile" or do {
+ unlink "$sigfile.tmp";
+ die "Could not write to $sigfile: $!";
+ };
+@@ -594,7 +610,7 @@ sub _mkdigest_files {
+ }
+ else {
+ local *F;
+- open F, $file or die "Cannot open $file for reading: $!";
++ open F, "< $file" or die "Cannot open $file for reading: $!";
+ if (-B $file) {
+ binmode(F);
+ $obj->addfile(*F);
diff --git a/debian/patches/series b/debian/patches/series
new file mode 100644
index 0000000..b503804
--- /dev/null
+++ b/debian/patches/series
@@ -0,0 +1 @@
+CVE-2015-3406_CVE-2015-3407_CVE-2015-3408.patch
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-perl/packages/libmodule-signature-perl.git
More information about the Pkg-perl-cvs-commits
mailing list