Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file

From	Chris Boot <crb@tiger-computing.co.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.security
Subject	Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file
Date	2016-01-12 18:40 +0100
Message-ID	<qQb5i-491-41@gated-at.bofh.it> (permalink)
References	<qQ6yC-WB-25@gated-at.bofh.it> <qQ71F-1nL-11@gated-at.bofh.it> <qQ7l0-1vx-21@gated-at.bofh.it> <qQ93t-2Pd-53@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On 12/01/16 15:27, Salvatore Bonaccorso wrote:
> My gut feeling about this: Since the issue was already present before,
> uncovered indirectly by the perl DSA, and currently affects twiki (not
> packaged in Debian), I would tend to ask the SRM to have the fix for
> libcgi-session-perl to be scheduled via the next Jessie point release
> rather than a DSA.
> 
> Do you feel strong about having it the fix earlier via a DSA?

I don't feel particularly strongly about it being fixed by a DSA as we
have a workaround (though the patch I included previously is incorrect
and broken; the patch in RT appears to work).

That being said, ikiwiki (packaged) appears to use CGI::Session so I
would be surprised if it was not affected, assuming it uses the same
session storage driver.

HTH,
Chris

-- 
Chris Boot

Tiger Computing Ltd
IS27001:2013 Certified

Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk

Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
 Wyastone Leys, Monmouth, NP25 3SR

Back to linux.debian.security | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 14:20 +0100
  Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Dominic Hargreaves <dom@earth.li> - 2016-01-12 14:50 +0100
    Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Salvatore Bonaccorso <carnil@debian.org> - 2016-01-12 16:40 +0100
      Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 18:40 +0100

csiph-web