Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #708329

Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file

Cross-posted to 2 groups.

Show all headers | View raw

Hi,

On Tue, Jan 12, 2016 at 01:38:51PM +0000, Dominic Hargreaves wrote:
> Control: tags -1 - security
> Control: found -1 4.46-1
> 
> On Tue, Jan 12, 2016 at 12:54:19PM +0000, Chris Boot wrote:
> > Control: tag -1 security
> > 
> > On 12/01/16 12:28, Chris Boot wrote:
> > [snip]
> > > Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=80346
> > > 
> > > Dear Maintainer,
> > > 
> > > With Perl upgraded from 5.20.2-3+deb8u1 to 5.20.2-3+deb8u2, our
> > > installation of TWiki (http://twiki.org/) no longer functions. This
> > > happens due to CGI::Session::Driver::file complaining about taint.
> > 
> > I'm bringing this bug to the attention of the security team, as it has
> > only come to light since the Jessie DSA of Perl (DSA-3441-1), so it's a
> > stable security regression.
> 
> Indeed, this is unfortunate - confirmed that this is trivially
> reproducible. It is misleading to call this a security bug in itself,
> so I am removing that tag.
> 
> I am happy to prepare an updated package with the patch in from the RT
> ticket, though it would be good to get some second opinions on the
> correctness of that patch. I guess that should be released as a DSA
> update, given (as you point out) it's a regression indirectly introduced
> by the DSA. Another alternative would be the jessie point release, which
> for which the freeze date is later this week.
> 
> I'm puzzled about why this wasn't spotted as an issue for wheezy, which
> doesn't have the perl taint bug, and does suffer from this problem: we
> should fix that there too, probably in the next point release.

My gut feeling about this: Since the issue was already present before,
uncovered indirectly by the perl DSA, and currently affects twiki (not
packaged in Debian), I would tend to ask the SRM to have the fix for
libcgi-session-perl to be scheduled via the next Jessie point release
rather than a DSA.

Do you feel strong about having it the fix earlier via a DSA?

Thanks for bringing that to our attention!

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 13:50 +0100
  Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 14:20 +0100
    Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Dominic Hargreaves <dom@earth.li> - 2016-01-12 14:50 +0100
      Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Salvatore Bonaccorso <carnil@debian.org> - 2016-01-12 16:40 +0100
        Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Chris Boot <crb@tiger-computing.co.uk> - 2016-01-12 18:40 +0100
      Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Niko Tyni <ntyni@debian.org> - 2016-01-12 23:40 +0100
        Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Niko Tyni <ntyni@debian.org> - 2016-01-14 23:10 +0100
      Bug#810799: libcgi-session-perl: Perl DSA-3441-1 exposes taint bug in CGI::Session::Driver::file Niko Tyni <ntyni@debian.org> - 2016-01-15 16:20 +0100

csiph-web