--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2015-5740
2015-04-09 15:41:05
--------------------------------------------------------------------------------
Name : perl-Test-Signature
Product : Fedora EPEL 5
Version : 1.11
Release : 1.el5
URL :
http://search.cpan.org/dist/Test-Signature/
Summary : Automated SIGNATURE testing
Description :
Module::Signature allows you to verify that a distribution has not been
tampered with. Test::Signature lets that be tested as part of the
distribution's test suite.
--------------------------------------------------------------------------------
Update Information:
This update addresses various security issues in perl-Module-Signature as described below.
The default behavior is also changed so as to ignore any MANIFEST.SKIP files unless a
"skip" parameter is specified. An updated version of perl-Test-Signature that
accounts for the changed default behavior is included in this update.
Security issues:
* Module::Signature before version 0.75 could be tricked into interpreting the unsigned
portion of a SIGNATURE file as the signed portion due to faulty parsing of the PGP
signature boundaries.
* When verifying the contents of a CPAN module, Module::Signature before version 0.75
ignored some files in the extracted tarball that were not listed in the signature file.
This included some files in the t/ directory that would execute
automatically during "make test".
* Module::Signature before version 0.75 used two argument open() calls to read the files
when generating checksums from the signed manifest. This allowed embedding arbitrary shell
commands into the SIGNATURE file that would execute during the signature verification
process.
* Module::Signature before version 0.75 has been loading several modules at runtime
inside the extracted module directory. Modules like Text::Diff are not guaranteed to be
available on all platforms and could be added to a malicious
module so that they would load from the '.' path in @INC.
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #1209911 - CVE-2015-3406 perl-Module-Signature: unsigned files interpreted as
signed in some circumstances
https://bugzilla.redhat.com/show_bug.cgi?id=1209911
[ 2 ] Bug #1209915 - CVE-2015-3407 perl-Module-Signature: arbitrary code execution
during test phase
https://bugzilla.redhat.com/show_bug.cgi?id=1209915
[ 3 ] Bug #1209917 - CVE-2015-3408 perl-Module-Signature: arbitrary code execution when
verifying module signatures
https://bugzilla.redhat.com/show_bug.cgi?id=1209917
[ 4 ] Bug #1209918 - CVE-2015-3409 perl-Module-Signature: arbitrary modules loading in
some circumstances
https://bugzilla.redhat.com/show_bug.cgi?id=1209918
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update perl-Test-Signature' at the command line.
For more information, refer to "Managing Software with yum",
available at
http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------