[Bug 1189334] New: CVE-2013-6499 perl-MP3-Info: loading a module relative to the cwd [fedora-all]
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1189334
Bug ID: 1189334
Summary: CVE-2013-6499 perl-MP3-Info: loading a module relative
to the cwd [fedora-all]
Product: Fedora
Version: 21
Component: perl-MP3-Info
Keywords: Security, SecurityTracking
Severity: medium
Priority: medium
Assignee: psabata(a)redhat.com
Reporter: kseifried(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: perl-devel(a)lists.fedoraproject.org, psabata(a)redhat.com
Blocks: 1018805 (CVE-2013-6499)
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time. If you need to fix the versions independent of each other,
you may clone this bug as appropriate.
[bug automatically created by: add-tracking-bugs]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1018805
[Bug 1018805] CVE-2013-6499 perl-MP3-Info: loading a module relative to the
cwd
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=6iXTSRybYc&a=cc_unsubscribe
9 years, 1 month
[Bug 1195338] New: perl-CGI-Application-Plugin-Authentication-0.20-11.fc23 FTBFS:
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1195338
Bug ID: 1195338
Summary: perl-CGI-Application-Plugin-Authentication-0.20-11.fc2
3 FTBFS:
Product: Fedora
Version: rawhide
Component: perl-CGI-Application-Plugin-Authentication
Assignee: emmanuel(a)seyman.fr
Reporter: ppisar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: emmanuel(a)seyman.fr, perl-devel(a)lists.fedoraproject.org
perl-CGI-Application-Plugin-Authentication-0.20-11.fc23 fails to build in F23
because tests fail:
# Failed test 'no warnings'
# at /usr/share/perl5/vendor_perl/Test/NoWarnings.pm line 45.
# There were 8 warning(s)
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x2910bc0), "authen_username") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x29109c8))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x29107e8),
"one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x29107e8),
"prerun", "one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x29107e8)) called at
t/03_login_box_basic.t line 65
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0), "empty",
CODE(0x268c2a8)) called at /usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("empty", CODE(0x268c2a8)) called at
t/03_login_box_basic.t line 82
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x2910bc0), "authen_password") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x29109c8))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x29107e8),
"one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x29107e8),
"prerun", "one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x29107e8)) called at
t/03_login_box_basic.t line 65
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0), "empty",
CODE(0x268c2a8)) called at /usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("empty", CODE(0x268c2a8)) called at
t/03_login_box_basic.t line 82
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x2910b60), "authen_username") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x2a46440))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x2a46008),
"two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x2a46008),
"prerun", "two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x2a46008)) called at
t/03_login_box_basic.t line 91
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0), "authenticated",
CODE(0x28f8c70)) called at /usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("authenticated", CODE(0x28f8c70)) called at
t/03_login_box_basic.t line 108
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x2910b60), "authen_password") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x2a46440))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x2a46008),
"two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x2a46008),
"prerun", "two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x2a46008)) called at
t/03_login_box_basic.t line 91
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0), "authenticated",
CODE(0x28f8c70)) called at /usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("authenticated", CODE(0x28f8c70)) called at
t/03_login_box_basic.t line 108
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x29fafb8), "authen_username") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x29faf58))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x2aefe28),
"two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x2aefe28),
"prerun", "two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x2aefe28)) called at
t/03_login_box_basic.t line 121
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0),
"failure_and_options", CODE(0x1f6ab20)) called at
/usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("failure_and_options", CODE(0x1f6ab20)) called at
t/03_login_box_basic.t line 132
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x29fafb8), "authen_password") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x29faf58))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x2aefe28),
"two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x2aefe28),
"prerun", "two") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x2aefe28)) called at
t/03_login_box_basic.t line 121
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0),
"failure_and_options", CODE(0x1f6ab20)) called at
/usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("failure_and_options", CODE(0x1f6ab20)) called at
t/03_login_box_basic.t line 132
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x2a46140), "authen_username") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x29faf28))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x2a5dbf0),
"one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x2a5dbf0),
"prerun", "one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x2a5dbf0)) called at
t/03_login_box_basic.t line 139
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0), "null",
CODE(0x1f6ab20)) called at /usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("null", CODE(0x1f6ab20)) called at
t/03_login_box_basic.t line 156
#
# ----------
# Previous test 0 ''
# CGI::param called in list context from package
CGI::Application::Plugin::Authentication line 1208, this can lead to
vulnerabilities. See the warning in "Fetching the value or values of a single
named parameter" at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# at /usr/share/perl5/vendor_perl/CGI.pm line 437.
# CGI::param(CGI=HASH(0x2a46140), "authen_password") called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1208
#
CGI::Application::Plugin::Authentication::initialize(CGI::Application::Plugin::Authentication=HASH(0x29faf28))
called at
/builddir/build/BUILD/CGI-Application-Plugin-Authentication-0.20/blib/lib/CGI/Application/Plugin/Authentication.pm
line 1367
#
CGI::Application::Plugin::Authentication::prerun_callback(TestAppAuthenticate=HASH(0x2a5dbf0),
"one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line 2402
# eval {...} called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
2402
# CGI::Application::call_hook(TestAppAuthenticate=HASH(0x2a5dbf0),
"prerun", "one") called at /usr/share/perl5/vendor_perl/CGI/Application.pm line
178
# CGI::Application::run(TestAppAuthenticate=HASH(0x2a5dbf0)) called at
t/03_login_box_basic.t line 139
# main::__ANON__() called at /usr/share/perl5/vendor_perl/Test/Builder.pm
line 261
# Test::Builder::__ANON__() called at
/usr/share/perl5/vendor_perl/Test/Builder.pm line 266
# eval {...} called at /usr/share/perl5/vendor_perl/Test/Builder.pm line
266
# Test::Builder::subtest(Test::Builder=HASH(0x1fa06d0), "null",
CODE(0x1f6ab20)) called at /usr/share/perl5/vendor_perl/Test/More.pm line 771
# Test::More::subtest("null", CODE(0x1f6ab20)) called at
t/03_login_box_basic.t line 156
#
t/03_login_box_basic.t ..............
Dubious, test returned 1 (wstat 256, 0x100)
Failed
Difference between working and failing build root is:
Removed packages:
cpp-5.0.0
cyrus-sasl-lib-2.1.26
elfutils-0.161
elfutils-libelf-0.161
elfutils-libs-0.161
file-5.22
file-libs-5.22
gcc-5.0.0
gcc-c++-5.0.0
isl-0.14
kernel-headers-3.19.0
krb5-libs-1.13
libblkid-2.26
libfdisk-2.26
libgcc-5.0.0
libgomp-5.0.0
libmount-2.26
libsmartcols-2.26
libstdc++-5.0.0
libstdc++-devel-5.0.0
libuuid-2.26
perl-CGI-4.04
perl-CGI-Application-Plugin-ActionDispatch-0.99
perl-DBD-Pg-3.4.2
perl-devel-5.20.1
perl-Getopt-Long-2.43
perl-Module-CoreList-5.20150120
perl-Pod-Perldoc-3.24
perl-Pod-Usage-1.64
perl-Socket-2.016
shared-mime-info-1.4
systemd-libs-218
util-linux-2.26
xz-5.2.0
xz-libs-5.2.0
Added packages:
kernel-headers-3.20.0
libxml2-2.9.2
mailcap-2.1.43
ncurses-5.9
ncurses-base-5.9
ncurses-libs-5.9
nss-tools-3.17.4
openldap-2.4.40
p11-kit-0.23.1
p11-kit-trust-0.23.1
pcre-8.36
perl-Business-ISBN-2.09
perl-Business-ISBN-Data-20140910.002
perl-CGI-4.13
perl-Compress-Raw-Bzip2-2.068
perl-Compress-Raw-Zlib-2.068
perl-DBD-Pg-3.5.1
perl-devel-5.20.2
perl-Encode-Locale-1.04
perl-Getopt-Long-2.44
perl-HTML-Parser-3.71
perl-HTML-Tagset-3.20
perl-HTTP-Date-6.02
perl-HTTP-Message-6.06
perl-IO-Compress-2.068
perl-IO-HTML-1.001
perl-LWP-MediaTypes-6.02
perl-Module-CoreList-5.20150214
perl-Pod-Perldoc-3.25
perl-Pod-Usage-1.65
perl-Socket-2.018
perl-TimeDate-2.30
perl-URI-1.65
redhat-rpm-config-28
systemd-libs-219
systemtap-sdt-devel-2.7
which-2.20
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=d1gMGuBN6V&a=cc_unsubscribe
9 years, 1 month
[Bug 905112] New: Update to metacpan.org instead of search.cpan.org
by Red Hat Bugzilla
Product: Fedora
https://bugzilla.redhat.com/show_bug.cgi?id=905112
Bug ID: 905112
Summary: Update to metacpan.org instead of search.cpan.org
Product: Fedora
Version: rawhide
Component: cpanspec
Severity: unspecified
Priority: unspecified
Reporter: berrange(a)redhat.com
Description of problem:
To quote:
http://perlhacks.com/2013/01/give-me-metacpan/
"Ever since MetaCPAN launched I’ve been getting increasingly irritated with
people who still use links to search.cpan.org. Isn’t it obvious that MetaCPAN
is better? Why do people still insist on sharing links to the older site?
Of course they do it for various reasons. Perhaps they aren’t as in touch with
the modern Perl world as I am. Perhaps they are wary about changing to use the
new shiny toys because they know that a newer shinier one will be along soon.
Perhaps I’m reading a web page from five years ago and they can be forgiven for
not linking to a site that didn’t exist at the time."
Fedora can do its bit to help this, by making cpanspec use metacpan.org instead
of search.cpan.org for newly generated specfiles.
Once cpanspec is updated, a bulk search-replace on all existing Fedora Perl
specs may be considered.
Version-Release number of selected component (if applicable):
cpanspec-1.78-12.fc18.noarch
How reproducible:
N/A
--
You are receiving this mail because:
You are on the CC list for the bug.
Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=feKMtj1zH9&a=cc_unsubscribe
9 years, 1 month