From c637a3b2f6cc066027b9ca0047f0117d4c4363ac Mon Sep 17 00:00:00 2001 From: overweight <5324761+overweight@user.noreply.gitee.com> Date: Mon, 30 Sep 2019 11:12:01 -0400 Subject: [PATCH] Package init --- ...event-loading-optional-modules-from-.patch | 41 ++++++++++++++ Digest-1.17.tar.gz | Bin 0 -> 9034 bytes perl-Digest.spec | 53 ++++++++++++++++++ 3 files changed, 94 insertions(+) create mode 100644 Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch create mode 100644 Digest-1.17.tar.gz create mode 100644 perl-Digest.spec diff --git a/Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch b/Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch new file mode 100644 index 0000000..5552a4b --- /dev/null +++ b/Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch @@ -0,0 +1,41 @@ +From 8cfc4916736280dd76655fdef5b78331bfac414d Mon Sep 17 00:00:00 2001 +From: Tony Cook +Date: Wed, 27 Jul 2016 14:04:59 +1000 +Subject: [PATCH] CVE-2016-1238: prevent loading optional modules from default + . + +Digest attempts to load Digest::SHA, only failing if Digest::SHA2 +is also unavailable. + +If a system has Digest installed, but not Digest::SHA, and a user +attempts to run a program using Digest with SHA-256 from a world +writable directory such as /tmp and since perl adds "." to the end +of @INC an attacker can run code as the original user by creating +/tmp/Digest/SHA.pm. + +The change temporarily removes the default "." entry from the end of +@INC preventing that attack. +--- + Digest.pm | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/Digest.pm b/Digest.pm +index 2ae6eec..c75649f 100644 +--- a/Digest.pm ++++ b/Digest.pm +@@ -42,7 +42,11 @@ sub new + unless (exists ${"$class\::"}{"VERSION"}) { + my $pm_file = $class . ".pm"; + $pm_file =~ s{::}{/}g; +- eval { require $pm_file }; ++ eval { ++ local @INC = @INC; ++ pop @INC if $INC[-1] eq '.'; ++ require $pm_file; ++ }; + if ($@) { + $err ||= $@; + next; +-- +2.1.4 + diff --git a/Digest-1.17.tar.gz b/Digest-1.17.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..301b0878f9219b7c29b68a0d808d27d490e5f3a8 GIT binary patch literal 9034 zcmV-QBemQgiwFqxIEYRH14LNOW*MbSW=RO( zLzX33WkphAU0IgPk~i6lQ>q~_BoToCgNG=_tNYvc>z=`jq8+cQ;<~E~%ViORnVz10 zeBIMCJPD>M&3dlwKHdK6Px?5H^K>*4{C7wHb^1g7*L;NQ?hO0RU^v(r3dbF|gZ@`y z^wk&muf{QH08b5hg)@k~Z|`ZM&uGaPo@{a5xx!C7i$X|EGWYj_dYZr|0yA5I>L%#F0$J0gL0sk(ULx>N1m=vb}hIXj$m> zR)tEYN|4Ri+)|Be?{xO41)oEs;%iq-l6WpsZ?;rPv^~zJ+w?9-)U~>mp&5A+M^7^0h4FZ-60!9{1d%Ytd>E;v z`1$SC*CS_VXYflgRh%d>SD8f5Ni3xAD_>->IF~nS5`@Zr^UC!6KDZOvY7rC3w`Xro z&rjSPry$sWRuDY${esCSsmO?TqLZ>n&I4~IRVaS2#ii~e+M`l7S2>>J2r@|mFSAYS zaU9*MBx6!3v6e&1S9sXlBj!!7cTpzC!DLk@r5C=pcaqQNE3l2R5(1SWb0n5Ca3j>6 zO1vOdAU#ucS+zUD2v~&iH1JA(!WaxtXOg>U6`i)`v7d*kB~s<(Nsz6?EXFKN1+=$h zIF0dkHt$&Y^d09}&)MlY&mLoFI}Z$PPzv+=I1!gGk9w}il2s`Rw1}~qkkZi{Or!c6 zSAayCPpJV`FkV5KaxSi*jT@B}#(9}97BTcuUsX#RL=P6x>O7$G-)fS`d7&tcrb&|V_xnTG<1$We>b#u8w#4O3g>gbd4^sa6 z!du9w!PJnH>O4yB4mTVznid|$prb*;U=LYT;47FbAP!a@c}h(3$Ri1+L?D|1iXavxNnlwxlQxAG>|B+LVGz2B_ zqBPd?lTm$QFm@XUek!~mA!AHxFKKKPFSW5g98VEFn+2&@Nbg1>ugNHdm?;FoO0|1? zWAI{-HuA!pq#!AjvK7iP@*`vZB3&rFWb7~HPva7m<{`X;LP{FX5qjr~P?e_4Zo`Zm zy*aB1&3&Xvm$+@vnp2Yqt~{XxB~>!%+#IMYMXssjCY2`vu5rgq>pwqE{HUk2V{xqEY3rpp@8g=Mol5fNb|pn zb1{>*$kt#m0EW6m;>Kg2Mg|cw@-S3>r7_2ST<~>tY-}VeK%j$XYwIeUA__77_7X&7gUdEm$5BF%2( zd?60_(Ke4SvR)j8L8NS79X3|)3?H+4w~^Oy!i;@Mq)MAD=5Q%Da|e%^Lxes0^6BOU-6EB4HDkEkcp14DK;LB{lEUc{lB38gYCcj zSN-Qp*MBq~^*GdgLH)Zz7Ome~-Hx~uyN=Tp__r&*6|jzBXCIS_EicXiug}Hs zTWZ|bj9vwEwYT>&c#9qJZ_9Ru#||?ow#@ebxu8ZvBD=#gai#;UUc$abk)-Vs4|{dn-N8< zPtS+3nsQ6`+9om;O$w$Mh=}$9f!`=cJW13feX=jMKG1@MEuQS{{p0lQ<=MsSC->rh zUz41GCcS1N@3U|0{zROAx1EA|*YLF6CV{e4zom&g)>nUh{(pQP#(#S;|DyH({%|xL z74aY8e?am7Y2Wz^|G&hi*s5yX?>E7pzTe7(fpyCui}>dJ{OFC?I(m0?@#^B}guu3Z z_gu8dk_fhRx96e_9Odnd+tMY?=ZE6wpIf!v2w=$l1rS=V&!Vl-r_Y^!=@!JO-1RYH zcvtUScudpqG{>bu%@n4Qjv}Oq;D1ipP72hkk|yQ=~cj-Pyj8@A}IObzU3?0 z#Zyi|_WGgfcrX6-FAlh-5-%D={zs(S?|=OJ_V#qYd|xiG>e$k6@AaQzs-OAGFGXI3 zDBk9lj_wx59?~czOSBxnam*EDyyuPcgleUsO3GDWcdSR#d(nQO3D&sh?1yE8wO;Sn z+c^oUTH3l_J-;&}k;5^w{M4yNJV;5(H)e@#br(=Mck4q-4}QP5*Si1EGPu#YuX9>( zyO>{dA^Ca1I1)qzr`CR>XVncl`LMTl|6%)n+U&w<>4)-+s~mCP?1t5~w_dDs!gD~n zFo)-y!LGlI)LqtWy|*5IOH@V&b$TVW+!Ip1Hj>nxIbCLL-fJT-fYw-gU5{&)+%R&T zVV5x7703mBbysgey7;8?_r96F&RRvv@CRO8INkO2>Fbm0Ys-2*Q_^?E>!b5i%QA(t zo;c@{f4W}GpTh(w#+aghIr{RSuP@$Qo?TLDV{7h@02IwC7~vapx0TMMyZ%<=UHKlU zy{QLR(TY9*=1qMF;>$k3-c5Z7#R+%NX*QQ$txEyL?X4TNqAq56C#RRkK&>knxMf|< zlsG;p5aQ6Bj-(HdJi0=LX{_Db7p+MUO;y5)eA=?$+pU>QXDS7P#uHuq^<^fz#Q<4I z+ZKZ6G?nB4KA5LD`m8z@k4oow*q-otSsMJVgMKtM!=#s?vwmSJO@>lY>YiBCSeYDh z1>X!V^o>bVf}s`Hoqo&t)Q5_s$vDUonXD|mBf_evN@`oyQA9=6ILRcoLW?BEmNZ+f zF;GsK(gbX3S$(0_*+CfGsBm>i^;&&cO1_=dI4fEsEy1Pax_=Z?-P9`QEyx?v<#`nr zfOSNwhjCSFS9ivsAhS%RcC5tN!AvGT^8#Jg6lA<4P7;+a;)w4eFgIM%we+OKR<&L~ zm`o@NL}C^%MN2QU#brKjpqXG8G8Ib|hWKkyvzkl-FEEwK6*EtQiRX(vql1Xoai%Ic zn$-s?E#zJkxRF~-=T5Z4<+-Q;U+Y8kWhBGZ?_`c#f%IlU1bWj1+)QMesRZjfn^46% z5puBz1CLASybb5NG+Bzaw3JR&5ckFk)+t(K9%&kk>G}be<0Hl8Oky;Zb7d9E0wrk# zMoTYkk~OppbTxlY$8=~?GF{R0BFv{?z=AKty?t;+1B-H=sbj1^DZU!r~^Dz zB@^j^6;lyLXV{f0%J=J&8ll#vB0QiYiz6s;6KE8tsl}qHVVcPKoOmebC)=?K^Mo^( zFZ8()pI*>X>IMUaiFo|0LMR6_%)3>MGq?`(lT_3%gqk*-+LSj~_4@D^Bdi3FsE=}? zlmzrcI^(M$6pxlTxRJWfRznz7hi%*&EZ<(Ai|7?L?|$DKnKr6 z4(1IIJHo-iEJ4_UXW)9J2KEpQVQdxN<6CRqo?$h7tHA(I+$wwE7!&6p-ib7%eV-`*ZlG~ zm`;LKsw8FTtz@7H2q13kLxqW20ARV3)#o%JKCfhcDGEUpW9&>V zZ6X_uxQZ?&WRO5AjOJC9s1T8t7!NKT&4jCJOh%qrj}zn&$y6Wf&;h;4;ws^R#Oa+R zPuio@fHutab7Ab8k=N+d!btnMKudee%s}bF6@vrACPjWDwi15Vmejh2<+Lbfwyw37 zTNWUcPN+GA&=6W}*EpYMIc>zq$N-g3xT~FDZkKt>#f3O~eRcZw`=jGiBmX#r;ga(8 zd6ohBTbPTMI)UwGtSY^BSXj5I!4}!mPe1*HbTgTDZQJgAqz@%w=ttYZPj}thL$@M@ zEj!W@JP0sLaxVj`g-AHs8nj~{hxy4xs?#wx9XgIPda#Vfdh2NjOyHj|Wx_AG4Ff`< z2Sb~X5V4<LSZ5B0j(zi zI(3Dzk+GVcfX*qf7j2%)m*Un(<>mC2i8zxuk9 z@pWv`{Z=!K_%S^KbNhtCOP7s~b)_K-Ti{%o=m0i2EArHup;pXy%3!p`N%6HgIN^2i z;kI!r`dX}AGXk+dn~U|d-7Ku~2;+qoT~u9ThlbmA2k#xSgS8Ybdt*_q{NQYHiQ8xaD0ts!v%8b~>6JH47z zz`6064SHfetwPaRs=|pjMIAQHwAzhJhS-kFM4wRkBRrAG=PCC&z7>cLQ z_(hb@seXr42ZHU7Mh}gYuMLTn@}0zq-n zsc?R_8%E52VNq8M4up2c{-R&m&~3$W3%gw=8z1^=RB+ ztjI_M(A&tHRwNtsSP{$YVyPJqvtGbnwG!K-ou=?AHY zO}E8aMS<-#r_k1dk+J6?o|F4VW`iQ>CVo9m^S&_6liFsyseEiqTga^ucd_|3JQ9Hg z*JiT@78xX67sW%n(-+hFdj*|)kMsYdv^4~ zbVgvLZAw7sL0gKoJhm!ju|p$!fM1yui6ek6^IJ8iB_SBn#;frP`R9sC(OfSvb5V%J zo@bG8)&oYGX;LXjPGa=UzG9thZMb4dvP{_=DCaYU z0AqifLL`U4b$(keKKh=M>*$E}pv(Ka@16H|M-H8G_R9eFu;59`XM>@gpRTT%>^4=k z0!L9Iv$W%B!_mHH@@XmNd6)&XNT_DFN*5ovvsD2*ff*$WAU|q5rL+5ZKpAKXUBeO znV;L$_;J<;i`$_+u-)d&qh0&i=L~jQlFdZxwf-qk{WANZ}X5P4F4DNr<%%2$i<19$RMI48l z2Uo9IV&x?6K$~a()8^SHH9PC(DW2K%E1e@Gy-9CSk{C3n=GSPub=D}bqV+|Wx{Wmk z<24T)txpXN=)r>;>uWQAdhj3kgZhnxu893|bT;1}A$%~L{f6EzX!7Gakld(v#QK;(D zm#3%V=+)(gWxYCBGXo^HRU5?AcrM)fuv;5QhxUzLFvqp$;o9@4K>&`^cu%mk-q562 zddnfQAGIvw@tT-S^rM1x;PbDA$9yw`(gNOER1_(KQHHyAz+zdmEL-etZ>z{&1~@e+?vrB=J8= z#Zpn(|CZ_n^#3T-OR4>D5|=WHlLBR-LKeTByXkM!{$L_`o*WSHe=K*T?lmJW4v~aq#PLK! zxE?uFiuNyWPfyxAr${%JEO9Q(T4Y|h@=dgp9alNn-{~B^?F6@^T1qn58!BYExJ-I$!1Hz-SNQVF(ugazT!eGwYpoE1(atIDuR?Q?+l zXo+pZpcY+;zWDbO^@LH2Qf(7UW~njLEw{xDb~8lcYoe1@}~_%sR+KJTqwVqKEjq7FqVm-b<%0?9(F9IFqI$J&ILYV zA^0FAdF5}8pjAM7x}gB2WD(%%`TMJZSap%nIU;-IP{-&Jv=_qPFw;sM8XqY{&7gPn-L z#2PAUQ7$K@#^?U92*T~@J%{bv}9LqDq);GRs)2+ zN-R*HM@gxpaHf;DEHJc2#q$ufzNlqT+zB}=x{{#*F=4ME!WEmlsDtDc$GYJo-CWF( zZlWjANzVW2UxWbuC-A?^^=gX$lr;ZWTegJxf2m%sN6!B%m3oT*l*qOIECl-$NTrNI z-P#hxQqv;ma|IT1;13mE2#TqsLNK+Gm|?<)Z12Bq(=j1@5-mtGE0AloU{nY3)mn>j zbjLKwQvqkhmS4~DAoX`h%5q`6#az<@>o=wa{L~>_l6_#X?)6;E7k-OCL)j+TL_WF}*Kh)mL#bBv9_-93-7zQmqD9|&VXadhR8zyp2;3Thz5d&i(slL`&hP%oi{D8&~`K1S>bH_ z=ZIV;z&iuXSFb=oJ@>cbZhECHKFu>xZ z0>EEf7pIJB5eh(ob>s#~IC#$QFshh_7|U$KqBfpVd=8ty5qpyJ^rFBkNRH;KfQe>S zf~1}?=0}px0&$ZF)?Z#!+jar;6WuIVs@QYDX!>9uji%_DZ38%&`qDvcH8Lvz zc5LZG09|jfB{H>X{W$VJsb`Wt|2N|QDEYsd;=led@_#id{;Pq%HyVB020$pF!2j=^ zKvYy`Aw9Y+P~y4?8i95uvO|bI!IT-F0sA5Jojfg+_|8@;HoUr=6wU~~S4!@=OUi5- z@+2l`xlh?Lxhlxu%4#L1V6)GgSFL@0r*Vzl4IOxc<}5R&Cz zIdu^73%47QO^Dofh;S(HHTI&56w3wTGi=4*i$&)4QpyZU}}tvIc||0|_b|NnII|9T`k+~>0%L8Dv`Mt$k(Gf=9b{yI zM5@>QbMxP@%6d}%UoF?t_^(g<{*_f;0{p*HEJXN!U8bh|KZz^4r{fco)iCg^&@rIj zfwRYN1($F1f?eJUY~!9v0)dzha3GI1ep2j3aJZhB2irf!PsWYk+%k7c~PN=y&B9q(I6tL#Vl?cJig6*?7@4fWr^jEjI|X#a*~_ zRt|g>DFEw12#nTGnT?H5^C9n1;Q~1RW=_Gt1kpHS;{z-?dj{TwH64?x^C%F0^q%K< zA<9&731$Jq-da09GyfovApDARY75af(SlD_!SpQxRa&5+M}wlF-(-{sr{;Bpg=p&t z*G@qTaj01W2_Pg;3T}!~O9>=xDJDYz*0zt0$F}WjR3>hI-fGL64iPv=b9%7FoP>G& zG!``Y{GQDk2`3A~x4>V*6BQINmF?FFeh2~P0-Q_PB>(Q(zo3A`pU-ak03c7#F!4j+ z#65pNd99`0Kiz6 z3#jXnLIR-BlJ0YEhP{RRLqS zZ`YUw!eu}uSWA`1cd(W!L1MHBw+#+007>1mJsmBxYesW=u}9yu`t4^}-L-~?Nt22P z%7hd=yzH70=K*s<;+@gAzVQq zfH2g5jMf(V0Q(r>05Cvmuniy`>Vhh!NZMh52}4Mte1A@udu~K{x)e zk7(LPV1p&VgQ^2mBm})=hhyC+tYZb{uiyerU87)~rWrcwg973INNBO(EWv~sFW7)p z?3rkSVf09rQV`EoAx{&UJFZpXFb*ONSgCP{Wgp6KpT^?k1Y0k8Y{WdM`_02HC7H2?qr literal 0 HcmV?d00001 diff --git a/perl-Digest.spec b/perl-Digest.spec new file mode 100644 index 0000000..c7be3d3 --- /dev/null +++ b/perl-Digest.spec @@ -0,0 +1,53 @@ +Name: perl-Digest +Version: 1.17 +Release: 419 +Summary: Modules that calculate message digests +License: GPL+ or Artistic +URL: https://metacpan.org/release/Digest +Source0: https://cpan.metacpan.org/authors/id/G/GA/GAAS/Digest-%{version}.tar.gz +Patch0001: Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch +BuildArch: noarch +BuildRequires: coreutils findutils make perl-interpreter perl-generators perl(Carp) perl(Exporter) perl(ExtUtils::MakeMaker) perl(MIME::Base64) +BuildRequires: perl(lib) perl(Test::More) +Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) perl(MIME::Base64) + +%description +The Digest:: modules calculate digests, also called "fingerprints" or +"hashes", of some data, called a message. The digest is (usually) +some small/fixed size string. The actual size of the digest depend of +the algorithm used. The message is simply a sequence of arbitrary +bytes or bits. + +%package_help + +%prep +%autosetup -n Digest-%{version} -p1 +chmod -x digest-bench + +%build +%{__perl} Makefile.PL NO_PACKLIST=1 INSTALLDIRS=vendor +%{make_build} + +%install +make pure_install PERL_INSTALL_ROOT=%{buildroot} +%{_fixperms} %{buildroot}/* + +%check +make test + +%files +%doc digest-bench README Changes +%{perl_vendorlib}/* + +%files help +%{_mandir}/*/* + +%changelog +* Sun Sep 29 2019 yefei - 1.17-419 +- Type:enhancement +- ID:NA +- SUG:NA +- DESC:delete irrelevant information + +* Sat Sep 14 2019 openEuler Buildteam - 1.17-418 +- Package init