Package: libdbi-perl / 1.631-3

Security-notice-for-Proxy.patch Patch series | download
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
From cd8fcbbf402e1d70c9f325f8b0fcd99e02cf14be Mon Sep 17 00:00:00 2001
From: Petr Písař <ppisar@redhat.com>
Date: Mon, 18 Nov 2013 12:52:09 +0100
Subject: [PATCH] Security notice for Proxy
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Bug: https://rt.cpan.org/Public/Bug/Display.html?id=90475

PlRPC is not secure due to Storable. Warn Proxy users about it.

Signed-off-by: Petr Písař <ppisar@redhat.com>
---
 lib/DBD/Proxy.pm       | 7 +++++++
 lib/DBI/ProxyServer.pm | 7 +++++++
 2 files changed, 14 insertions(+)

diff --git a/lib/DBD/Proxy.pm b/lib/DBD/Proxy.pm
index 287b2dc..5948255 100644
--- a/lib/DBD/Proxy.pm
+++ b/lib/DBD/Proxy.pm
@@ -974,6 +974,13 @@ The workaround is storing the modified local copy back to the server:
   $dbh->{"csv_tables"} = $tables;
 
 
+=head1 SECURITY WARNING
+
+L<RPC::PlClient> used underneath is not secure due to serializing and
+deserializing data with L<Storable> module. Use the proxy driver only in
+trusted environment.
+
+
 =head1 AUTHOR AND COPYRIGHT
 
 This module is Copyright (c) 1997, 1998
diff --git a/lib/DBI/ProxyServer.pm b/lib/DBI/ProxyServer.pm
index 68ad4af..78a0d78 100644
--- a/lib/DBI/ProxyServer.pm
+++ b/lib/DBI/ProxyServer.pm
@@ -867,6 +867,13 @@ Don't try to put parameters into the sql-query like this:
 =back
 
 
+=head1 SECURITY WARNING
+
+L<RPC::PlServer> used underneath is not secure due to serializing and
+deserializing data with L<Storable> module. Use the proxy driver only in
+trusted environment.
+
+
 =head1 AUTHOR
 
     Copyright (c) 1997    Jochen Wiedmann
-- 
1.8.3.1