Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4469 > unrolled thread

Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 14:20 +0100
    Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Dominic Hargreaves <dom@earth.li> - 2016-01-12 14:50 +0100
      Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Salvatore Bonaccorso <carnil@debian.org> - 2016-01-12 16:40 +0100
        Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 18:40 +0100

#4469 — Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file

Control: tag -1 security

On 12/01/16 12:28, Chris Boot wrote:
[snip]
> Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=80346
> 
> Dear Maintainer,
> 
> With Perl upgraded from 5.20.2-3+deb8u1 to 5.20.2-3+deb8u2, our
> installation of TWiki (http://twiki.org/) no longer functions. This
> happens due to CGI::Session::Driver::file complaining about taint.

I'm bringing this bug to the attention of the security team, as it has
only come to light since the Jessie DSA of Perl (DSA-3441-1), so it's a
stable security regression.

Regards,
Chris

-- 
Chris Boot

Tiger Computing Ltd
IS27001:2013 Certified

Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk

Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
 Wyastone Leys, Monmouth, NP25 3SR

[toc] | [next] | [standalone]

#4470

Control: tags -1 - security
Control: found -1 4.46-1

On Tue, Jan 12, 2016 at 12:54:19PM +0000, Chris Boot wrote:
> Control: tag -1 security
> 
> On 12/01/16 12:28, Chris Boot wrote:
> [snip]
> > Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=80346
> > 
> > Dear Maintainer,
> > 
> > With Perl upgraded from 5.20.2-3+deb8u1 to 5.20.2-3+deb8u2, our
> > installation of TWiki (http://twiki.org/) no longer functions. This
> > happens due to CGI::Session::Driver::file complaining about taint.
> 
> I'm bringing this bug to the attention of the security team, as it has
> only come to light since the Jessie DSA of Perl (DSA-3441-1), so it's a
> stable security regression.

Indeed, this is unfortunate - confirmed that this is trivially
reproducible. It is misleading to call this a security bug in itself,
so I am removing that tag.

I am happy to prepare an updated package with the patch in from the RT
ticket, though it would be good to get some second opinions on the
correctness of that patch. I guess that should be released as a DSA
update, given (as you point out) it's a regression indirectly introduced
by the DSA. Another alternative would be the jessie point release, which
for which the freeze date is later this week.

I'm puzzled about why this wasn't spotted as an issue for wheezy, which
doesn't have the perl taint bug, and does suffer from this problem: we
should fix that there too, probably in the next point release.

Dominic.

[toc] | [prev] | [next] | [standalone]

#4471

Hi,

On Tue, Jan 12, 2016 at 01:38:51PM +0000, Dominic Hargreaves wrote:
> Control: tags -1 - security
> Control: found -1 4.46-1
> 
> On Tue, Jan 12, 2016 at 12:54:19PM +0000, Chris Boot wrote:
> > Control: tag -1 security
> > 
> > On 12/01/16 12:28, Chris Boot wrote:
> > [snip]
> > > Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=80346
> > > 
> > > Dear Maintainer,
> > > 
> > > With Perl upgraded from 5.20.2-3+deb8u1 to 5.20.2-3+deb8u2, our
> > > installation of TWiki (http://twiki.org/) no longer functions. This
> > > happens due to CGI::Session::Driver::file complaining about taint.
> > 
> > I'm bringing this bug to the attention of the security team, as it has
> > only come to light since the Jessie DSA of Perl (DSA-3441-1), so it's a
> > stable security regression.
> 
> Indeed, this is unfortunate - confirmed that this is trivially
> reproducible. It is misleading to call this a security bug in itself,
> so I am removing that tag.
> 
> I am happy to prepare an updated package with the patch in from the RT
> ticket, though it would be good to get some second opinions on the
> correctness of that patch. I guess that should be released as a DSA
> update, given (as you point out) it's a regression indirectly introduced
> by the DSA. Another alternative would be the jessie point release, which
> for which the freeze date is later this week.
> 
> I'm puzzled about why this wasn't spotted as an issue for wheezy, which
> doesn't have the perl taint bug, and does suffer from this problem: we
> should fix that there too, probably in the next point release.

My gut feeling about this: Since the issue was already present before,
uncovered indirectly by the perl DSA, and currently affects twiki (not
packaged in Debian), I would tend to ask the SRM to have the fix for
libcgi-session-perl to be scheduled via the next Jessie point release
rather than a DSA.

Do you feel strong about having it the fix earlier via a DSA?

Thanks for bringing that to our attention!

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#4472

On 12/01/16 15:27, Salvatore Bonaccorso wrote:
> My gut feeling about this: Since the issue was already present before,
> uncovered indirectly by the perl DSA, and currently affects twiki (not
> packaged in Debian), I would tend to ask the SRM to have the fix for
> libcgi-session-perl to be scheduled via the next Jessie point release
> rather than a DSA.
> 
> Do you feel strong about having it the fix earlier via a DSA?

I don't feel particularly strongly about it being fixed by a DSA as we
have a workaround (though the patch I included previously is incorrect
and broken; the patch in RT appears to work).

That being said, ikiwiki (packaged) appears to use CGI::Session so I
would be surprised if it was not affected, assuming it uses the same
session storage driver.

HTH,
Chris

-- 
Chris Boot

Tiger Computing Ltd
IS27001:2013 Certified

Tel: 01600 483 484
Web: https://www.tiger-computing.co.uk

Registered in England. Company number: 3389961
Registered address: Wyastone Business Park,
 Wyastone Leys, Monmouth, NP25 3SR

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web