Debian Bug report logs -
#1033109
libcpan-checksums-perl: CVE-2020-16155
Reported by: Moritz Mühlenhoff <jmm@inutil.org>
Date: Fri, 17 Mar 2023 13:54:01 UTC
Severity: important
Tags: security, upstream
Found in version libcpan-checksums-perl/2.12-1
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
:
Bug#1033109
; Package src:libcpan-checksums-perl
.
(Fri, 17 Mar 2023 13:54:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Mühlenhoff <jmm@inutil.org>
:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
.
(Fri, 17 Mar 2023 13:54:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: libcpan-checksums-perl
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerability was published for libcpan-checksums-perl.
CVE-2020-16155[0]:
| The CPAN::Checksums package 2.12 for Perl does not uniquely define
| signed data.
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2020-16155
https://www.cve.org/CVERecord?id=CVE-2020-16155
Please adjust the affected versions in the BTS as needed.
Added tag(s) upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Fri, 17 Mar 2023 17:03:12 GMT) (full text, mbox, link).
Marked as found in versions libcpan-checksums-perl/2.12-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org
.
(Fri, 17 Mar 2023 17:03:13 GMT) (full text, mbox, link).
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
:
Bug#1033109
; Package src:libcpan-checksums-perl
.
(Fri, 17 Mar 2023 20:20:39 GMT) (full text, mbox, link).
Acknowledgement sent
to gregor herrmann <gregoa@debian.org>
:
Extra info received and forwarded to list. Copy sent to Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
.
(Fri, 17 Mar 2023 20:20:39 GMT) (full text, mbox, link).
Message #14 received at 1033109@bugs.debian.org (full text, mbox, reply):
[Message part 1 (text/plain, inline)]
On Fri, 17 Mar 2023 14:50:29 +0100, Moritz Mühlenhoff wrote:
> CVE-2020-16155[0]:
> | The CPAN::Checksums package 2.12 for Perl does not uniquely define
> | signed data.
>
> https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
> http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
After reading those webpages and looking at the diffs briefly, I
_think_ this is fixed upstream in 2.13 and in Debian with 2.13-1.
What do you think Salvatore?
Cheers,
gregor
--
.''`. https://info.comodo.priv.at -- Debian Developer https://www.debian.org
: :' : OpenPGP fingerprint D1E1 316E 93A7 60A8 104D 85FA BB3A 6801 8649 AA06
`. `' Member VIBE!AT & SPI Inc. -- Supporter Free Software Foundation Europe
`-
[signature.asc (application/pgp-signature, inline)]
Information forwarded
to debian-bugs-dist@lists.debian.org, Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
:
Bug#1033109
; Package src:libcpan-checksums-perl
.
(Fri, 17 Mar 2023 20:45:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>
:
Extra info received and forwarded to list. Copy sent to Debian Perl Group <pkg-perl-maintainers@lists.alioth.debian.org>
.
(Fri, 17 Mar 2023 20:45:04 GMT) (full text, mbox, link).
Message #19 received at 1033109@bugs.debian.org (full text, mbox, reply):
Hi Gregor,
On Fri, Mar 17, 2023 at 09:15:12PM +0100, gregor herrmann wrote:
> On Fri, 17 Mar 2023 14:50:29 +0100, Moritz Mühlenhoff wrote:
>
> > CVE-2020-16155[0]:
> > | The CPAN::Checksums package 2.12 for Perl does not uniquely define
> > | signed data.
> >
> > https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
> > http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
>
> After reading those webpages and looking at the diffs briefly, I
> _think_ this is fixed upstream in 2.13 and in Debian with 2.13-1.
>
> What do you think Salvatore?
My understanding so far was that the issue is not solely
CPAN::Checksums, but a combination of what we can control in
CPAN::Checksums and on the way the module was called on CPAN.
2.13 adds the additional required path component, so maybe you are
right and we should consider the CVE addressed on the package side
with the addition of the cpan_path key.
For reference:
https://github.com/andk/cpan-checksums/commit/9d2f5f26470ff7ce53ef697d09790fc4db451ab1
Regards,
Salvatore
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Sat Mar 18 13:09:14 2023;
Machine Name:
bembo
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.