Debian Bug report logs -
#954238
libperlspeak-perl: CVE-2020-10674
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, team@security.debian.org, gregoa@debian.org, Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>:
Bug#954238; Package src:libperlspeak-perl.
(Thu, 19 Mar 2020 04:57:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, team@security.debian.org, gregoa@debian.org, Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>.
(Thu, 19 Mar 2020 04:57:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: libperlspeak-perl
Version: 2.01-2
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=132173
Control: tags -1 + stretch buster bullseye sid
Hi,
The following vulnerability was published for libperlspeak-perl.
CVE-2020-10674[0]:
| PerlSpeak through 2.01 allows attackers to execute arbitrary OS
| commands, as demonstrated by use of system and 2-argument open.
Gregor, the module seem to be basically unmaintained, I would propose
to actually remove the package from unstable and likely given there
are no reverse dependencies as well from any other suite. What do you
think?
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-10674
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10674
[1] https://rt.cpan.org/Public/Bug/Display.html?id=132173
Regards,
Salvatore
Added tag(s) sid, stretch, buster, and bullseye.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to submit@bugs.debian.org.
(Thu, 19 Mar 2020 04:57:04 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Thu Mar 19 08:34:06 2020;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon