Compare commits
10 Commits
d3569e57d7
...
fe3f83ccd1
| Author | SHA1 | Date | |
|---|---|---|---|
|
|
fe3f83ccd1 | ||
|
|
ac81fe878d | ||
|
|
6e3eb8cf8c | ||
|
|
23e730fee1 | ||
|
|
d1f5950748 | ||
|
|
b9b4f04e1d | ||
|
|
9458e996dd | ||
|
|
16c9a42320 | ||
|
|
0ef413b699 | ||
|
|
476c9fdd58 |
@ -1,41 +0,0 @@
|
||||
From 8cfc4916736280dd76655fdef5b78331bfac414d Mon Sep 17 00:00:00 2001
|
||||
From: Tony Cook <tony@develop-help.com>
|
||||
Date: Wed, 27 Jul 2016 14:04:59 +1000
|
||||
Subject: [PATCH] CVE-2016-1238: prevent loading optional modules from default
|
||||
.
|
||||
|
||||
Digest attempts to load Digest::SHA, only failing if Digest::SHA2
|
||||
is also unavailable.
|
||||
|
||||
If a system has Digest installed, but not Digest::SHA, and a user
|
||||
attempts to run a program using Digest with SHA-256 from a world
|
||||
writable directory such as /tmp and since perl adds "." to the end
|
||||
of @INC an attacker can run code as the original user by creating
|
||||
/tmp/Digest/SHA.pm.
|
||||
|
||||
The change temporarily removes the default "." entry from the end of
|
||||
@INC preventing that attack.
|
||||
---
|
||||
Digest.pm | 6 +++++-
|
||||
1 file changed, 5 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/Digest.pm b/Digest.pm
|
||||
index 2ae6eec..c75649f 100644
|
||||
--- a/Digest.pm
|
||||
+++ b/Digest.pm
|
||||
@@ -42,7 +42,11 @@ sub new
|
||||
unless (exists ${"$class\::"}{"VERSION"}) {
|
||||
my $pm_file = $class . ".pm";
|
||||
$pm_file =~ s{::}{/}g;
|
||||
- eval { require $pm_file };
|
||||
+ eval {
|
||||
+ local @INC = @INC;
|
||||
+ pop @INC if $INC[-1] eq '.';
|
||||
+ require $pm_file;
|
||||
+ };
|
||||
if ($@) {
|
||||
$err ||= $@;
|
||||
next;
|
||||
--
|
||||
2.1.4
|
||||
|
||||
Binary file not shown.
BIN
Digest-1.20.tar.gz
Normal file
BIN
Digest-1.20.tar.gz
Normal file
Binary file not shown.
@ -1,15 +1,15 @@
|
||||
Name: perl-Digest
|
||||
Version: 1.17
|
||||
Release: 419
|
||||
Version: 1.20
|
||||
Release: 4
|
||||
Summary: Modules that calculate message digests
|
||||
License: GPL+ or Artistic
|
||||
License: GPL-1.0-or-later OR Artistic-1.0-Perl
|
||||
URL: https://metacpan.org/release/Digest
|
||||
Source0: https://cpan.metacpan.org/authors/id/G/GA/GAAS/Digest-%{version}.tar.gz
|
||||
Patch0001: Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch
|
||||
Source0: https://cpan.metacpan.org/authors/id/T/TO/TODDR/Digest-%{version}.tar.gz
|
||||
|
||||
BuildArch: noarch
|
||||
BuildRequires: coreutils findutils make perl-interpreter perl-generators perl(Carp) perl(Exporter) perl(ExtUtils::MakeMaker) perl(MIME::Base64)
|
||||
BuildRequires: perl(lib) perl(Test::More)
|
||||
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) perl(MIME::Base64)
|
||||
Requires: perl(MIME::Base64)
|
||||
|
||||
%description
|
||||
The Digest:: modules calculate digests, also called "fingerprints" or
|
||||
@ -43,6 +43,18 @@ make test
|
||||
%{_mandir}/*/*
|
||||
|
||||
%changelog
|
||||
* Tue Jan 07 2025 Funda Wang <fundawang@yeah.net> - 1.20-4
|
||||
- cleanup spec
|
||||
|
||||
* Sat Nov 26 2022 huyubiao <huyubiao@huawei.com> - 1.20-3
|
||||
- Update the Source0 URL.
|
||||
|
||||
* Fri Jun 24 2022 Chenyx <chenyixiong3@huawei.com> - 1.20-2
|
||||
- License compliance rectification
|
||||
|
||||
* Sat Dec 25 2021 tianwei <tianwei12@huawei.com> - 1.20-1
|
||||
- Upgrade to 1.20
|
||||
|
||||
* Sun Sep 29 2019 yefei <yefei25@huawei.com> - 1.17-419
|
||||
- Type:enhancement
|
||||
- ID:NA
|
||||
|
||||
148
perl-Digest.yaml
148
perl-Digest.yaml
@ -1,145 +1,5 @@
|
||||
---
|
||||
version_control: metacpan
|
||||
src_repo: Digest
|
||||
tag_prefix: "^v"
|
||||
git_url: https://github.com/guillemj/perl-Digest.git
|
||||
version_control: github
|
||||
src_repo: guillemj/perl-Digest
|
||||
tag_prefix:
|
||||
seperator: "."
|
||||
last_query:
|
||||
time_stamp: 2020-04-26 07:39:41.029696510 +00:00
|
||||
raw_data: |
|
||||
{
|
||||
"download_url" : "https://cpan.metacpan.org/authors/id/G/GA/GAAS/Digest-1.17.tar.gz",
|
||||
"name" : "Digest-1.17",
|
||||
"date" : "2011-10-02T10:14:32",
|
||||
"maturity" : "released",
|
||||
"dependency" : [
|
||||
{
|
||||
"module" : "MIME::Base64",
|
||||
"phase" : "runtime",
|
||||
"version" : "0",
|
||||
"relationship" : "requires"
|
||||
},
|
||||
{
|
||||
"relationship" : "requires",
|
||||
"version" : "5.004",
|
||||
"phase" : "runtime",
|
||||
"module" : "perl"
|
||||
},
|
||||
{
|
||||
"relationship" : "requires",
|
||||
"version" : "0.47",
|
||||
"phase" : "runtime",
|
||||
"module" : "Test::More"
|
||||
},
|
||||
{
|
||||
"version" : "0",
|
||||
"relationship" : "requires",
|
||||
"phase" : "build",
|
||||
"module" : "ExtUtils::MakeMaker"
|
||||
},
|
||||
{
|
||||
"relationship" : "requires",
|
||||
"version" : "0",
|
||||
"phase" : "configure",
|
||||
"module" : "ExtUtils::MakeMaker"
|
||||
}
|
||||
],
|
||||
"abstract" : "Modules that calculate message digests",
|
||||
"first" : false,
|
||||
"status" : "latest",
|
||||
"distribution" : "Digest",
|
||||
"changes_file" : "Changes",
|
||||
"checksum_sha256" : "2f6a54459fc7f37c0669d548bb224b695eb8d2ddc089aa5547645ce1f5fd86f7",
|
||||
"version_numified" : 1.17,
|
||||
"author" : "GAAS",
|
||||
"archive" : "Digest-1.17.tar.gz",
|
||||
"license" : [
|
||||
"perl_5"
|
||||
],
|
||||
"main_module" : "Digest",
|
||||
"resources" : {
|
||||
"repository" : {
|
||||
"url" : "http://github.com/gisle/digest"
|
||||
}
|
||||
},
|
||||
"checksum_md5" : "2f8a38f7f6c1bd2df36feb16d8208d6d",
|
||||
"authorized" : true,
|
||||
"provides" : [
|
||||
"Digest",
|
||||
"Digest::base",
|
||||
"Digest::file"
|
||||
],
|
||||
"stat" : {
|
||||
"mode" : 33188,
|
||||
"mtime" : 1317550472,
|
||||
"uid" : 1009,
|
||||
"size" : 9034,
|
||||
"gid" : 1009
|
||||
},
|
||||
"version" : "1.17",
|
||||
"id" : "s28cotdaj30r4LZua7D1DSJ7Biw",
|
||||
"deprecated" : "false",
|
||||
"metadata" : {
|
||||
"license" : [
|
||||
"perl_5"
|
||||
],
|
||||
"author" : [
|
||||
"Gisle Aas <gisle@activestate.com>"
|
||||
],
|
||||
"name" : "Digest",
|
||||
"release_status" : "stable",
|
||||
"resources" : {
|
||||
"repository" : {
|
||||
"url" : "http://github.com/gisle/digest"
|
||||
}
|
||||
},
|
||||
"dynamic_config" : 1,
|
||||
"no_index" : {
|
||||
"directory" : [
|
||||
"t",
|
||||
"inc",
|
||||
"t",
|
||||
"xt",
|
||||
"inc",
|
||||
"local",
|
||||
"perl5",
|
||||
"fatlib",
|
||||
"example",
|
||||
"blib",
|
||||
"examples",
|
||||
"eg"
|
||||
]
|
||||
},
|
||||
"version" : "1.17",
|
||||
"meta-spec" : {
|
||||
"version" : "2",
|
||||
"url" : "http://search.cpan.org/perldoc?CPAN::Meta::Spec"
|
||||
},
|
||||
"abstract" : "Modules that calculate message digests",
|
||||
"generated_by" : "ExtUtils::MakeMaker version 6.57_05, CPAN::Meta::Converter version 2.150005",
|
||||
"prereqs" : {
|
||||
"build" : {
|
||||
"requires" : {
|
||||
"ExtUtils::MakeMaker" : "0"
|
||||
}
|
||||
},
|
||||
"runtime" : {
|
||||
"requires" : {
|
||||
"perl" : "5.004",
|
||||
"MIME::Base64" : "0",
|
||||
"Test::More" : "0.47"
|
||||
}
|
||||
},
|
||||
"configure" : {
|
||||
"requires" : {
|
||||
"ExtUtils::MakeMaker" : "0"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"tests" : {
|
||||
"fail" : 2,
|
||||
"unknown" : 5,
|
||||
"pass" : 2682,
|
||||
"na" : 0
|
||||
}
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user