[Bug 1646738] CVE-2018-18313 perl: Heap-based buffer read overflow
in S_grok_bslash_N()
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1646738
Paul Harvey <pharvey(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=low,public=20181129, |impact=low,public=20181129,
|reported=20181105,source=up |reported=20181105,source=up
|stream,cvss3=6.5/CVSS:3.0/A |stream,cvss3=6.5/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:L/ |V:N/AC:H/PR:N/UI:N/S:U/C:L/
|I:N/A:H,cwe=CWE-125,rhel-6/ |I:N/A:H,cwe=CWE-125,rhel-6/
|perl=notaffected,openshift- |perl=notaffected,openshift-
|enterprise-3/perl=new,fedor |enterprise-3/perl=notaffect
|a-all/perl=affected,rhel-5/ |ed,fedora-all/perl=affected
|perl=notaffected,rhel-7/per |,rhel-5/perl=notaffected,rh
|l=notaffected,openshift-onl |el-7/perl=notaffected,opens
|ine-3/perl=new,rhel-8/perl= |hift-online-3/perl=notaffec
|affected,rhscl-3/rh-perl526 |ted,rhel-8/perl=affected,rh
|-perl=affected,rhscl-3/rh-p |scl-3/rh-perl526-perl=affec
|erl524-perl=affected,rhel-8 |ted,rhscl-3/rh-perl524-perl
|/perl:5.24/perl=affected |=affected,rhel-8/perl:5.24/
| |perl=affected
--- Comment #11 from Paul Harvey <pharvey(a)redhat.com> ---
openshift-enterprise-3: notaffected. I reviewed OpenShift containers for
applications with dependencies on perl and was unable to identify any where the
perl interpreter would be exposed to attacker-controlled regular expressions
which could expose this flaw. There is a perl dependency in our MariaDB
packaging, however the only non-test related perl usage is in a backup script
(mysqlhotcopy) which is not exposed to attacker-controlled regular expressions.
I have not filed trackers as these images will inherit the existing perl fixes
next time they are respun. See also https://access.redhat.com/articles/2803031
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months
[Bug 1646734] CVE-2018-18312 perl: Heap-based buffer overflow in
S_handle_regex_sets()
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1646734
Paul Harvey <pharvey(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1129,reported=20181105,sour |1129,reported=20181105,sour
|ce=upstream,cvss3=7.0/CVSS: |ce=upstream,cvss3=7.0/CVSS:
|3.0/AV:N/AC:H/PR:N/UI:N/S:U |3.0/AV:N/AC:H/PR:N/UI:N/S:U
|/C:L/I:L/A:H,cwe=CWE-22,rhe |/C:L/I:L/A:H,cwe=CWE-22,rhe
|l-6/perl=notaffected,opensh |l-6/perl=notaffected,opensh
|ift-enterprise-3/perl=new,f |ift-enterprise-3/perl=notaf
|edora-all/perl=affected,rhe |fected,fedora-all/perl=affe
|l-5/perl=notaffected,rhel-7 |cted,rhel-5/perl=notaffecte
|/perl=notaffected,openshift |d,rhel-7/perl=notaffected,o
|-online-3/perl=new,rhel-8/p |penshift-online-3/perl=nota
|erl=affected,rhscl-3/rh-per |ffected,rhel-8/perl=affecte
|l526-perl=affected,rhscl-3/ |d,rhscl-3/rh-perl526-perl=a
|rh-perl524-perl=affected,rh |ffected,rhscl-3/rh-perl524-
|el-8/perl:5.24/perl=affecte |perl=affected,rhel-8/perl:5
|d |.24/perl=affected
--- Comment #9 from Paul Harvey <pharvey(a)redhat.com> ---
openshift-enterprise-3: notaffected. I reviewed OpenShift containers for
applications with dependencies on perl and was unable to identify any where the
perl interpreter would be exposed to attacker-controlled regular expressions
which could expose this flaw. There is a perl dependency in our MariaDB
packaging, however the only non-test related perl usage is in a backup script
(mysqlhotcopy) which is not exposed to attacker-controlled regular expressions.
I have not filed trackers as these images will inherit the existing perl fixes
next time they are respun. See also https://access.redhat.com/articles/2803031
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months
[Bug 1646730] CVE-2018-18311 perl: Integer overflow leading to
buffer overflow in Perl_my_setenv()
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1646730
Paul Harvey <pharvey(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|81129,reported=20181105,sou |81129,reported=20181105,sou
|rce=upstream,cvss3=8.1/CVSS |rce=upstream,cvss3=8.1/CVSS
|:3.0/AV:N/AC:H/PR:N/UI:N/S: |:3.0/AV:N/AC:H/PR:N/UI:N/S:
|U/C:H/I:H/A:H,cwe=CWE-190-> |U/C:H/I:H/A:H,cwe=CWE-190->
|CWE-120,rhel-6/perl=wontfix |CWE-120,rhel-6/perl=wontfix
|,openshift-enterprise-3/per |,openshift-enterprise-3/per
|l=new,fedora-all/perl=affec |l=notaffected,fedora-all/pe
|ted,rhel-5/perl=wontfix,rhe |rl=affected,rhel-5/perl=won
|l-7/perl=affected,openshift |tfix,rhel-7/perl=affected,o
|-online-3/perl=new,rhel-8/p |penshift-online-3/perl=nota
|erl=affected,rhscl-3/rh-per |ffected,rhel-8/perl=affecte
|l526-perl=affected,rhscl-3/ |d,rhscl-3/rh-perl526-perl=a
|rh-perl524-perl=affected,rh |ffected,rhscl-3/rh-perl524-
|ev-m-4/redhat-virtualizatio |perl=affected,rhev-m-4/redh
|n-host=defer/impact=low,rhe |at-virtualization-host=defe
|v-m-4/rhvm-appliance=defer/ |r/impact=low,rhev-m-4/rhvm-
|impact=low,rhel-8/perl:5.24 |appliance=defer/impact=low,
|/perl=affected |rhel-8/perl:5.24/perl=affec
| |ted
--- Comment #13 from Paul Harvey <pharvey(a)redhat.com> ---
openshift-enterprise-3: notaffected. I reviewed OpenShift containers for
applications with dependencies on perl and was unable to identify any where the
perl interpreter would be exposed to attacker-controlled environment variables
which could expose this flaw. I have not filed trackers as these images will
inherit the existing perl fixes next time they are respun. See also
https://access.redhat.com/articles/2803031
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months
[Bug 1668968] New: failed to build transaction
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1668968
Bug ID: 1668968
Summary: failed to build transaction
Product: Fedora
Version: rawhide
Hardware: x86_64
OS: Linux
Status: NEW
Component: perl
Severity: medium
Assignee: jplesnik(a)redhat.com
Reporter: lui(a)fgcint.com
QA Contact: extras-qa(a)fedoraproject.org
CC: caillon+fedoraproject(a)gmail.com, iarnell(a)gmail.com,
jplesnik(a)redhat.com, kasal(a)ucw.cz,
mbarnes(a)fastmail.com, mmaslano(a)redhat.com,
perl-devel(a)lists.fedoraproject.org, ppisar(a)redhat.com,
psabata(a)redhat.com, rhughes(a)redhat.com,
sandmann(a)redhat.com, tcallawa(a)redhat.com
Target Milestone: ---
Classification: Fedora
Description of problem:
/etc/cron.daily/0yum-daily.cron
Failed to check for updates with the following error message:
Version-Release number of selected component (if applicable):
perl.x86_64 4:5.28.1-427.fc29
How reproducible:
Daily when run and also if executed from shell as root
Steps to Reproduce:
1. Allow 0yum-daily.cron to execute and look at email sent
Actual results:
Failed to check for updates with the following error message:
Failed to build transaction: perl-HTTP-Tiny-0.076-1.module_2543+eed510a0.noarch
requires perl(:MODULE_COMPAT_5.26.2)
perl-Archive-Zip-1.64-1.module_2543+eed510a0.noarch requires
perl(:MODULE_COMPAT_5.26.2)
perl-perlfaq-5.20180915-1.module_2543+eed510a0.noarch requires
perl(:MODULE_COMPAT_5.26.2)
perl-threads-shared-1.59-1.module_2543+eed510a0.x86_64 requires
perl(:MODULE_COMPAT_5.26.2)
perl-Locale-Codes-3.59-1.module_2543+eed510a0.noarch requires
perl(:MODULE_COMPAT_5.26.2)
perl-threads-shared-1.59-1.module_2543+eed510a0.x86_64 requires
libperl.so.5.26()(64bit)
perl-PathTools-3.75-1.module_2543+eed510a0.x86_64 requires
libperl.so.5.26()(64bit)
perl-File-Path-2.16-1.module_2543+eed510a0.noarch requires
perl(:MODULE_COMPAT_5.26.2)
perl-Thread-Queue-3.13-1.module_2543+eed510a0.noarch requires
perl(:MODULE_COMPAT_5.26.2)
perl-PathTools-3.75-1.module_2543+eed510a0.x86_64 requires
perl(:MODULE_COMPAT_5.26.2)
perl-DB_File-1.843-1.module_2543+eed510a0.x86_64 requires
libperl.so.5.26()(64bit)
perl-DB_File-1.843-1.module_2543+eed510a0.x86_64 requires
perl(:MODULE_COMPAT_5.26.2)
Expected results:
Should run without error and check for updates etc
Additional info:
I use dnf to do my updates and that still is working fine and updates
accordingly. I tend to update weekly.
I have tried downgrading perl back to the version the other routines wand but I
can only go back to 5.28.0
I have checked the updates-testing to see if newer versions of the other
routines are available but it appears I am on the latest.
This started happing about 2 weeks ago and I have finally decided I cannot
locate any obvious fix.
If more information required just ask and I will try and provide it.
I am fairly sure that if all the routines/modules are recomplied up to a newer
version that may well fix it. Just looks like they have got out of sync with
each other.
I am thinking I will disable this anyway (once this is resolved) as I said
above I weekly (approx) update my systems anyway so it really is not required
in my case.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months
[Bug 1665836] New: Upgrade perl-Config-Model-TkUI to 1.369
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1665836
Bug ID: 1665836
Summary: Upgrade perl-Config-Model-TkUI to 1.369
Product: Fedora
Version: rawhide
Status: NEW
Component: perl-Config-Model-TkUI
Assignee: david.hannequin(a)gmail.com
Reporter: jplesnik(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: david.hannequin(a)gmail.com,
perl-devel(a)lists.fedoraproject.org
Target Milestone: ---
Classification: Fedora
Latest Fedora delivers 1.368 version. Upstream released 1.369. When you have
free time, please upgrade it.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months
[Bug 1663979] New: perl-Business-Hours-0.12-15.fc30 FTBFS:
t/1-business-hours.t tests fail
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1663979
Bug ID: 1663979
Summary: perl-Business-Hours-0.12-15.fc30 FTBFS:
t/1-business-hours.t tests fail
Product: Fedora
Version: rawhide
URL: https://apps.fedoraproject.org/koschei/build/5875455
Status: NEW
Component: perl-Business-Hours
Assignee: rc040203(a)freenet.de
Reporter: ppisar(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: lxtnow(a)gmail.com, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Target Milestone: ---
Classification: Fedora
perl-Business-Hours-0.12-15.fc30 fails to build in Fedora 30 because some tests
fail:
+ make test
PERL_DL_NONLAZY=1 "/usr/bin/perl" "-MExtUtils::Command::MM" "-MTest::Harness"
"-e" "undef *Test::Harness::Switches; test_harness(0, 'blib/lib', 'blib/arch')"
t/*.t
# Failed test at t/1-business-hours.t line 16.
# got: '0'
# expected: '162000'
# Failed test 'Got seconds'
# at t/1-business-hours.t line 24.
# Failed test at t/1-business-hours.t line 27.
# got: '0'
# expected: '162000'
# Failed test at t/1-business-hours.t line 50.
# got: '374400'
# expected: '28800'
Set::IntSpan::_copy_run_list: Bad order 2: 72000--1
at
/home/test/fedora/perl-Business-Hours/Business-Hours-0.12/blib/lib/Business/Hours.pm
line 270.
# Looks like your test exited with 255 just after 12.
t/1-business-hours.t ..
Dubious, test returned 255 (wstat 65280, 0xff00)
Failed 9/17 subtests
A difference between a passing and failing build root is at
<https://apps.fedoraproject.org/koschei/build/5875455>. But downgrading any of
these packages did not help.
Changing a time before 2019-01-01T00:00:00 helps.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months
[Bug 1665830] New: Upgrade perl-Business-Hours to 0.13
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1665830
Bug ID: 1665830
Summary: Upgrade perl-Business-Hours to 0.13
Product: Fedora
Version: rawhide
Status: NEW
Component: perl-Business-Hours
Assignee: rc040203(a)freenet.de
Reporter: jplesnik(a)redhat.com
QA Contact: extras-qa(a)fedoraproject.org
CC: lxtnow(a)gmail.com, perl-devel(a)lists.fedoraproject.org,
rc040203(a)freenet.de
Target Milestone: ---
Classification: Fedora
Latest Fedora delivers 0.12 version. Upstream released 0.13. When you have free
time, please upgrade it.
--
You are receiving this mail because:
You are on the CC list for the bug.
5 years, 2 months