perl: CVE-2013-1667: rehashing flaw

Debian Bug report logs - #702296
perl: CVE-2013-1667: rehashing flaw

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: perl: CVE-2013-1667: rehashing flaw

Date: Mon, 04 Mar 2013 21:56:34 +0100

Source: perl
Version: 5.10.1-17squeeze4
Severity: grave
Tags: security patch
Control: found -1 5.16.2-1

Hi Niko and Dominic

A a hash-related flaw was announced today and CVE-2013-1667 assigned
to it.

For further reference see [1,2].

 [1]: http://www.nntp.perl.org/group/perl.perl5.porters/2013/03/msg199755.html
 [2]: https://security-tracker.debian.org/tracker/CVE-2013-1667

Could you please include the CVE identifier when fixing the issue? I
assume this should get a DSA.

Regards,
Salvatore

Message #14 received at 702296-close@bugs.debian.org (full text, mbox, reply):

From: Niko Tyni <ntyni@debian.org>

To: 702296-close@bugs.debian.org

Subject: Bug#702296: fixed in perl 5.14.2-19

Date: Wed, 06 Mar 2013 16:48:12 +0000

Source: perl
Source-Version: 5.14.2-19

We believe that the bug you reported is fixed in the latest version of
perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 702296@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Niko Tyni <ntyni@debian.org> (supplier of updated perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 05 Mar 2013 21:38:26 +0200
Source: perl
Binary: perl-base libcgi-fast-perl perl-doc perl-modules perl-debug libperl5.14 libperl-dev perl
Architecture: source all amd64
Version: 5.14.2-19
Distribution: unstable
Urgency: high
Maintainer: Niko Tyni <ntyni@debian.org>
Changed-By: Niko Tyni <ntyni@debian.org>
Description: 
 libcgi-fast-perl - CGI::Fast Perl module
 libperl-dev - Perl library: development files
 libperl5.14 - shared Perl library
 perl       - Larry Wall's Practical Extraction and Report Language
 perl-base  - minimal Perl system
 perl-debug - debug-enabled Perl interpreter
 perl-doc   - Perl documentation
 perl-modules - Core Perl modules
Closes: 702296
Changes: 
 perl (5.14.2-19) unstable; urgency=high
 .
   * [SECURITY] CVE-2013-1667: fix a rehashing DoS opportunity
     against code that uses arbitrary user input as hash keys.
     (Closes: #702296)
Checksums-Sha1: 
 fb316d9d58ff4fd69356327a50c18373e7d2f08a 1729 perl_5.14.2-19.dsc
 77d6413ce30f7daa6afc6c3627ebed9bf632811c 159828 perl_5.14.2-19.debian.tar.gz
 d483546f7450184b70cd2ffc95aa3e137bcbf5c7 76310 libcgi-fast-perl_5.14.2-19_all.deb
 2420ff48e4cee63b69c3f2f42ba47a6d49c7e04f 8169446 perl-doc_5.14.2-19_all.deb
 5692728f36bf5744bcd3969c31cff24aa80998e7 3442406 perl-modules_5.14.2-19_all.deb
 dbd70548a0781dec255a3ca7d270328e778437db 1536792 perl-base_5.14.2-19_amd64.deb
 c1dd31c73200902cadabb88cecbef98213ae6e93 8006914 perl-debug_5.14.2-19_amd64.deb
 a1310fae9473e8a98a81001bef49e9ef5adfe43e 1176 libperl5.14_5.14.2-19_amd64.deb
 88f34c94f3861425efa31479d4c43297d19de76e 3321392 libperl-dev_5.14.2-19_amd64.deb
 e28b29034b0b0f59a614dcd4fcb1ac108a3fae29 4426220 perl_5.14.2-19_amd64.deb
Checksums-Sha256: 
 8eb1318dcec244350033abe4193a1032cd679686f0c4a2cbf678b278e5b3e07e 1729 perl_5.14.2-19.dsc
 42fbdca35c0e19a8ae80e1b3aaae78aad44886378ecded062de93c050e76868e 159828 perl_5.14.2-19.debian.tar.gz
 8c14daabc25bb76bbb448c5ecd6eb2f4fa9102a8b3efec2fb2378e9a366537f8 76310 libcgi-fast-perl_5.14.2-19_all.deb
 ffbec9376ce8b8b29a232d59c2fa94f2df5b703c217e01b28f255335bb32221d 8169446 perl-doc_5.14.2-19_all.deb
 b40b0ca5f7a933c3efd101b22170af6419c75996f02762730a809bb7684b7919 3442406 perl-modules_5.14.2-19_all.deb
 473f4f8488764e37cb47f63e23e0146949fdfe30827537eb7d647943c78a26d3 1536792 perl-base_5.14.2-19_amd64.deb
 8898717660c245b535bf696b6d3f789c150053fd1e6354e14d7b0f1863c42e7b 8006914 perl-debug_5.14.2-19_amd64.deb
 b328239cff9422c1e6a5d95012459f00689080b8f62efb3bedf19b8dbe947458 1176 libperl5.14_5.14.2-19_amd64.deb
 aa8b393e381f955be54f885e870de32efb8f22786e34880e6dee5edec9b1c412 3321392 libperl-dev_5.14.2-19_amd64.deb
 b4d3a83b12e6751473c6955e997cbef80b8f66a942bbe86513f2d7d2a87b17f0 4426220 perl_5.14.2-19_amd64.deb
Files: 
 96533842a0d8a399c48efbcb292320c6 1729 perl standard perl_5.14.2-19.dsc
 94936f2a96bbf7472ad51f841408bef8 159828 perl standard perl_5.14.2-19.debian.tar.gz
 588f843ab24a876b61dea8937ec04b3f 76310 perl optional libcgi-fast-perl_5.14.2-19_all.deb
 d93a76c270ea1ea27a5edbe7d518590d 8169446 doc optional perl-doc_5.14.2-19_all.deb
 d6d39f80db3c816747fc7b53244a357f 3442406 perl standard perl-modules_5.14.2-19_all.deb
 70c02da46c3fb6242593a982b5832b30 1536792 perl required perl-base_5.14.2-19_amd64.deb
 fce56f9b527abf094407363011a22404 8006914 debug extra perl-debug_5.14.2-19_amd64.deb
 5451e89c189452d1cd36e5814efb597d 1176 libs optional libperl5.14_5.14.2-19_amd64.deb
 08de15f72da2326aae3dcaa5ca4cfbc6 3321392 libdevel optional libperl-dev_5.14.2-19_amd64.deb
 2ae840a004a0a8d6f1c6fa813eaeda9c 4426220 perl standard perl_5.14.2-19_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlE2X7oACgkQiyizGWoHLTl6wACcD7UtfBCGzptdavkOLFuHzX2E
zsYAoMK8WIWF/koIczeegd9sKWeIHKUj
=BUT1
-----END PGP SIGNATURE-----

Message #21 received at 702296-close@bugs.debian.org (full text, mbox, reply):

From: Niko Tyni <ntyni@debian.org>

To: 702296-close@bugs.debian.org

Subject: Bug#702296: fixed in perl 5.10.1-17squeeze6

Date: Sun, 10 Mar 2013 17:02:06 +0000

Source: perl
Source-Version: 5.10.1-17squeeze6

We believe that the bug you reported is fixed in the latest version of
perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 702296@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Niko Tyni <ntyni@debian.org> (supplier of updated perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 05 Mar 2013 21:50:01 +0200
Source: perl
Binary: perl-base libcgi-fast-perl perl-doc perl-modules perl-debug perl-suid libperl5.10 libperl-dev perl
Architecture: source all amd64
Version: 5.10.1-17squeeze6
Distribution: stable-security
Urgency: low
Maintainer: Niko Tyni <ntyni@debian.org>
Changed-By: Niko Tyni <ntyni@debian.org>
Description: 
 libcgi-fast-perl - CGI::Fast Perl module
 libperl-dev - Perl library: development files
 libperl5.10 - shared Perl library
 perl       - Larry Wall's Practical Extraction and Report Language
 perl-base  - minimal Perl system
 perl-debug - debug-enabled Perl interpreter
 perl-doc   - Perl documentation
 perl-modules - Core Perl modules
 perl-suid  - runs setuid Perl scripts
Closes: 702296
Changes: 
 perl (5.10.1-17squeeze6) stable-security; urgency=low
 .
   * [SECURITY] CVE-2013-1667: fix a rehashing DoS opportunity
     against code that uses arbitrary user input as hash keys.
     (Closes: #702296)
Checksums-Sha1: 
 488edb6ddc1fa76badba7beb0ade6fb8c1f1d948 1430 perl_5.10.1-17squeeze6.dsc
 04c8395af0ca7248fc5b64518ccfad5a195f7b6f 125772 perl_5.10.1-17squeeze6.debian.tar.gz
 ff452e91444360db7b2dd8304280b073b42c5835 53712 libcgi-fast-perl_5.10.1-17squeeze6_all.deb
 c90b5500fa1cf89f1922fbbd9a1a2fa09ab6ba98 7189730 perl-doc_5.10.1-17squeeze6_all.deb
 d51c79b0e7e30051935b429af1dd22b77ed186c8 3482294 perl-modules_5.10.1-17squeeze6_all.deb
 85abfad822b16896be7b944c2cac017594aa3590 1068082 perl-base_5.10.1-17squeeze6_amd64.deb
 84f288cb17e0420ad9b754b7419adfa2c557885b 5837214 perl-debug_5.10.1-17squeeze6_amd64.deb
 19e8acdf311e5b5ff2d1c529fbb3dc8a52bec203 35570 perl-suid_5.10.1-17squeeze6_amd64.deb
 6435927ea6d63d86da1eca85183dfc58fab75bb2 1160 libperl5.10_5.10.1-17squeeze6_amd64.deb
 50d37a23f640abfed9f4e58c33c1e7c3d7aeaef6 2562998 libperl-dev_5.10.1-17squeeze6_amd64.deb
 fb2fdafd5531cd987efd9441fe832cf5973d61d8 4462038 perl_5.10.1-17squeeze6_amd64.deb
Checksums-Sha256: 
 6eec91b67b1a9fd48c67e73d1cd621010543fe8328e3e2f9c1e5fc9313ade10a 1430 perl_5.10.1-17squeeze6.dsc
 bfb33256fa4c8a53d4fc56cc54a9a36777a54c3307ee70df62faf871f29fa931 125772 perl_5.10.1-17squeeze6.debian.tar.gz
 39e53b62e970e09be21bfd909cabc3960884a632dabd72af5756cad5af84fcff 53712 libcgi-fast-perl_5.10.1-17squeeze6_all.deb
 9b61d9b11dce8b12939bfd04192a148e46a191dee909b3fa2c074a0554a19e67 7189730 perl-doc_5.10.1-17squeeze6_all.deb
 de4b3a6162401f65cbb5947dd69fabc4d6c1b1dac36cf7fcb667777c5a2dbc9a 3482294 perl-modules_5.10.1-17squeeze6_all.deb
 1924efff0d5f4159c001b1a08653ee4c5f26fb3230e97aeae5dd01668172dddf 1068082 perl-base_5.10.1-17squeeze6_amd64.deb
 b78bfb8e3c15dc1b4fa98dcc3e57bfa328eac2c08007e4a96da29583f58c7a2f 5837214 perl-debug_5.10.1-17squeeze6_amd64.deb
 6e148996ca9cc422dbc908b4d7f8325550b458ba02c005d567310f1e543a0dd7 35570 perl-suid_5.10.1-17squeeze6_amd64.deb
 f15574d7c769649e4785c34f9034c0b90a639564594276ef915d73500f14a0f2 1160 libperl5.10_5.10.1-17squeeze6_amd64.deb
 c648c16a122d76b37bbc3d5208c2759821c353604cd9f438358ad30a78cd7db1 2562998 libperl-dev_5.10.1-17squeeze6_amd64.deb
 3e8e7999c8cba242ade748c672598131567099bf0c76062e0237e95fe713ac45 4462038 perl_5.10.1-17squeeze6_amd64.deb
Files: 
 96899b902fa0f73d010f09954ad716e9 1430 perl standard perl_5.10.1-17squeeze6.dsc
 3cedc82d59fdacc3f6d2e9dc11b28f29 125772 perl standard perl_5.10.1-17squeeze6.debian.tar.gz
 aecceb2f7be91ee7b48b0ce648e10253 53712 perl optional libcgi-fast-perl_5.10.1-17squeeze6_all.deb
 c77c08ae0bed7cf73962abb9e0fdb486 7189730 doc optional perl-doc_5.10.1-17squeeze6_all.deb
 645adc6122fefb77a48fd3ca5a9bc833 3482294 perl standard perl-modules_5.10.1-17squeeze6_all.deb
 1b7ae006df5ff8e93e2b0b7df84b88bd 1068082 perl required perl-base_5.10.1-17squeeze6_amd64.deb
 426eaedde4dfb43f500e27f5b812ab6c 5837214 debug extra perl-debug_5.10.1-17squeeze6_amd64.deb
 66c02dc8bb13b03b22cff06529f29798 35570 perl optional perl-suid_5.10.1-17squeeze6_amd64.deb
 50e84875aa88d26f86c1fccab71ae634 1160 libs optional libperl5.10_5.10.1-17squeeze6_amd64.deb
 117cc8476d16b6ed053bada63c6fe07a 2562998 libdevel optional libperl-dev_5.10.1-17squeeze6_amd64.deb
 83a6de18491d5ad6459ed68f51730347 4462038 perl standard perl_5.10.1-17squeeze6_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEUEARECAAYFAlE3aVgACgkQiyizGWoHLTk1NwCY0RWsN6dp280uL6F8fR4WB/+x
dQCeJgO6Gdk8icLCLKE3QiL1EbFToqc=
=EQkV
-----END PGP SIGNATURE-----

Message #26 received at 702296-close@bugs.debian.org (full text, mbox, reply):

From: Dominic Hargreaves <dom@earth.li>

To: 702296-close@bugs.debian.org

Subject: Bug#702296: fixed in perl 5.16.3-1

Date: Wed, 13 Mar 2013 00:17:58 +0000

Source: perl
Source-Version: 5.16.3-1

We believe that the bug you reported is fixed in the latest version of
perl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 702296@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Dominic Hargreaves <dom@earth.li> (supplier of updated perl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 12 Mar 2013 23:08:47 +0000
Source: perl
Binary: perl-base libcgi-fast-perl perl-doc perl-modules perl-debug libperl5.16 libperl-dev perl
Architecture: source all i386
Version: 5.16.3-1
Distribution: experimental
Urgency: low
Maintainer: Niko Tyni <ntyni@debian.org>
Changed-By: Dominic Hargreaves <dom@earth.li>
Description: 
 libcgi-fast-perl - CGI::Fast Perl module
 libperl-dev - Perl library: development files
 libperl5.16 - shared Perl library
 perl       - Larry Wall's Practical Extraction and Report Language
 perl-base  - minimal Perl system
 perl-debug - debug-enabled Perl interpreter
 perl-doc   - Perl documentation
 perl-modules - Core Perl modules
Closes: 678138 698174 698320 702094 702296 702416 702562
Changes: 
 perl (5.16.3-1) experimental; urgency=low
 .
   * Remove Depends/Recommends/Suggests on modules deprecated in 5.12 and
     5.14 (Closes: #702094)
   * Fix FTBFS with findutils from experimental by not using deprecated
     permissions check syntax; thanks to Roland Stigge (Closes: #702562)
   * Merge 5.14.2-17, 5.14.2-18, 5.14.2-19 and 5.14.2-20 from unstable
     + Fix a double-free bug in Digest::SHA. (Closes: #698174)
       + update the Breaks: entry accordingly.
     + Avoid wraparound when casting unsigned size_t to signed ssize_t.
       (Closes: #698320)
     + [SECURITY] CVE-2013-1667: fix a rehashing DoS opportunity
       against code that uses arbitrary user input as hash keys.
       (Closes: #702296)
     + Fix an Encode memory leak that occurred in the UTF-8 encoding.
       (Closes: #702416)
       + upgrade the Broken versions of the separate libencode-perl
         package accordingly.
   * Update debian/t/control.t to reflect Module::CoreList version
     inconsistency and to remove references to non-existent Breaks
   * Remove unneeded versioned dependencies on gcc and cpio
     (Closes: #678138)
   * Fix debian/copyright syntax (thanks, Lintian)
   * Include correct branch name in Vcs-Git field
   * New upstream release
Checksums-Sha1: 
 5d0f7607020abd977486a0a4b418dcece95150de 1705 perl_5.16.3-1.dsc
 060bc17cf9f142d043f9bf7b861422ec624875ea 13724906 perl_5.16.3.orig.tar.bz2
 631b183937ff539b4361af7f5c4923011920305d 127498 perl_5.16.3-1.debian.tar.gz
 e03a4805d611836c9969aaa73a5429bd42ae58e3 75866 libcgi-fast-perl_5.16.3-1_all.deb
 b7cd0a30c32be7248e4c746e0142ca03c5059b9d 7905192 perl-doc_5.16.3-1_all.deb
 8219757f25af30e401ce52d78b42a7d5856a971f 3836026 perl-modules_5.16.3-1_all.deb
 558346974745ad712e2eeed7ef3f91e70e8ee6bb 1528894 perl-base_5.16.3-1_i386.deb
 8d4884f3ab524ace00341e16d48c3b5ee837d50d 9258026 perl-debug_5.16.3-1_i386.deb
 265a0d43f3773ec3ad9d5263e8da4d7a3eaf4706 762998 libperl5.16_5.16.3-1_i386.deb
 cf1ea91354f7ff66426b51d729e139322adb4c8b 3162010 libperl-dev_5.16.3-1_i386.deb
 6cb3abc3d59ad2252c319b376d3da48d063e3fa5 3706398 perl_5.16.3-1_i386.deb
Checksums-Sha256: 
 e6276eb0436aecb9c2047a138f3a11c21f4ee0f541ca370d34fd2bb4c9697b9d 1705 perl_5.16.3-1.dsc
 bb7bc735e6813b177dcfccd480defcde7eddefa173b5967eac11babd1bfa98e8 13724906 perl_5.16.3.orig.tar.bz2
 391d843d8855a6a6437cec2cfcd992bf71a9fee35d0a7c2674672254b97bfc45 127498 perl_5.16.3-1.debian.tar.gz
 e3c94db606bd035745c7259f400ad35f0c5e0cf99487506a4df8a3b82a4239f2 75866 libcgi-fast-perl_5.16.3-1_all.deb
 a46e2bf544104d439aa94dcc3feddd3271e836147f5ecf802e3347ab46470e61 7905192 perl-doc_5.16.3-1_all.deb
 8c36a6f3b03b465ed320f5dd4683f7c8392aa5db3e6c71eda7c85cc60b33fe04 3836026 perl-modules_5.16.3-1_all.deb
 578865b02ae4f2cd0e8cfbacc57551fbac5cdb94dd89951ea9b23f2f0a3c4618 1528894 perl-base_5.16.3-1_i386.deb
 c1d25fba85c6eb5e03dae0a1f29650b71d85f2ec5c59ef98b6311af9dcb2e489 9258026 perl-debug_5.16.3-1_i386.deb
 9ff77a248791dde88b72d3738304429f0c458f6bc9b1b5cfcedb0f94e80c99d4 762998 libperl5.16_5.16.3-1_i386.deb
 64f41120a575daeb9cba8c5540c53bf073701b5c207ceccb28a04159c626cd2e 3162010 libperl-dev_5.16.3-1_i386.deb
 364ccbc5790cd661ad3e4af08fb0762bbe4ae8d4dd7affa507df66e16c20186b 3706398 perl_5.16.3-1_i386.deb
Files: 
 710059d45f42fd1e860629f66754f6ca 1705 perl standard perl_5.16.3-1.dsc
 025102de0e4a597cf541e57da80c6aa3 13724906 perl standard perl_5.16.3.orig.tar.bz2
 8429fd17b7a25b4925705fea50bffdf1 127498 perl standard perl_5.16.3-1.debian.tar.gz
 4c4d769e887596ebdbd1567b45528915 75866 perl optional libcgi-fast-perl_5.16.3-1_all.deb
 787ac68a69da8a1e98b38fc382db2f44 7905192 doc optional perl-doc_5.16.3-1_all.deb
 5843c3b48dbe90b9b7e347e01325ca03 3836026 perl standard perl-modules_5.16.3-1_all.deb
 61666fe98c67f8c22a4e79b297c20b62 1528894 perl required perl-base_5.16.3-1_i386.deb
 c7cf9d87092c43f6694bb75b7e7148ae 9258026 debug extra perl-debug_5.16.3-1_i386.deb
 152fa79dd793e204ada7331abea9a0a4 762998 libs optional libperl5.16_5.16.3-1_i386.deb
 052f60e24825c992cfeebf07ace0d1b6 3162010 libdevel optional libperl-dev_5.16.3-1_i386.deb
 3ec6da29b5181633d0edee0ee5832cf1 3706398 perl standard perl_5.16.3-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFRP8NgYzuFKFF44qURAubQAJ0as1romee4UwCplaAnEv0yDK3sjACgr7rY
o1YHQvRmRytJLdX92ycDQrs=
=fnI2
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.