1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
|
Description: Fix CVE-2015-3406, CVE-2015-3407 and CVE-2015-3408
CVE-2015-3406: Module::Signature parses the unsigned portion of the
SIGNATURE file as the signed portion due to incorrect handling of PGP
signature boundaries.
.
CVE-2015-3407: Module::Signature incorrectly handles files that are not
listed in the SIGNATURE file. This includes some files in the t/
directory that would execute when tests are run.
.
CVE-2015-3408: Module::Signature uses two argument open() calls to read
the files when generating checksums from the signed manifest, allowing
to embed arbitrary shell commands into the SIGNATURE file that would
execute during the signature verification process.
Origin: upstream, https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
Bug-Debian: https://bugs.debian.org/783451
Forwarded: not-needed
Author: Audrey Tang <audreyt@audreyt.org>
Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Santiago Ruano Rincón <santiagorr@riseup.net>
Last-Update: 2015-06-30
Applied-Upstream: 0.75
--- a/Makefile.PL
+++ b/Makefile.PL
@@ -9,6 +9,7 @@
repository 'http://github.com/audreyt/module-signature';
install_script 'script/cpansign';
build_requires 'Test::More';
+requires 'File::Temp';
# On Win32 (excluding cygwin) we know that IO::Socket::INET,
# which is needed for keyserver stuff, doesn't work. In fact
--- a/lib/Module/Signature.pm
+++ b/lib/Module/Signature.pm
@@ -52,8 +52,22 @@
$AutoKeyRetrieve = 1;
$CanKeyRetrieve = undef;
+sub _cipher_map {
+ my($sigtext) = @_;
+ my @lines = split /\015?\012/, $sigtext;
+ my %map;
+ for my $line (@lines) {
+ last if $line eq '-----BEGIN PGP SIGNATURE-----';
+ next if $line =~ /^---/ .. $line eq '';
+ my($cipher,$digest,$file) = split " ", $line, 3;
+ return unless defined $file;
+ $map{$file} = [$cipher, $digest];
+ }
+ return \%map;
+}
+
sub verify {
- my %args = ( skip => 1, @_ );
+ my %args = ( @_ );
my $rv;
(-r $SIGNATURE) or do {
@@ -66,7 +80,7 @@
return SIGNATURE_MALFORMED;
};
- (my ($cipher) = ($sigtext =~ /^(\w+) /)) or do {
+ (my ($cipher) = _cipher_map($sigtext)) or do {
warn "==> MALFORMED Signature file! <==\n";
return SIGNATURE_MALFORMED;
};
@@ -160,6 +174,11 @@
($mani, $file) = ExtUtils::Manifest::fullcheck();
}
else {
+ my $_maniskip = &ExtUtils::Manifest::maniskip;
+ local *ExtUtils::Manifest::maniskip = sub { sub {
+ return unless $skip;
+ return $_maniskip->(@_);
+ } };
($mani, $file) = ExtUtils::Manifest::fullcheck();
}
@@ -199,6 +218,11 @@
my $keyserver = _keyserver($version);
+ require File::Temp;
+ my $fh = File::Temp->new();
+ print $fh $sigtext;
+ close $fh;
+
my @quiet = $Verbose ? () : qw(-q --logger-fd=1);
my @cmd = (
qw(gpg --verify --batch --no-tty), @quiet, ($KeyServer ? (
@@ -206,7 +230,7 @@
($AutoKeyRetrieve and $version ge '1.0.7')
? '--keyserver-options=auto-key-retrieve'
: ()
- ) : ()), $SIGNATURE
+ ) : ()), $fh->filename
);
my $output = '';
@@ -218,6 +242,7 @@
my $cmd = join ' ', @cmd;
$output = `$cmd`;
}
+ unlink $fh->filename;
if( $? ) {
print STDERR $output;
@@ -246,7 +271,7 @@
my $pgp = Crypt::OpenPGP->new(
($KeyServer) ? ( KeyServer => $KeyServer, AutoKeyRetrieve => $AutoKeyRetrieve ) : (),
);
- my $rv = $pgp->handle( Filename => $SIGNATURE )
+ my $rv = $pgp->handle( Data => $sigtext )
or die $pgp->errstr;
return SIGNATURE_BAD if (!$rv->{Validity} and $AutoKeyRetrieve);
@@ -269,32 +294,35 @@
my $well_formed;
local *D;
- open D, $sigfile or die "Could not open $sigfile: $!";
+ open D, "< $sigfile" or die "Could not open $sigfile: $!";
if ($] >= 5.006 and <D> =~ /\r/) {
close D;
- open D, $sigfile or die "Could not open $sigfile: $!";
+ open D, '<', $sigfile or die "Could not open $sigfile: $!";
binmode D, ':crlf';
} else {
close D;
- open D, $sigfile or die "Could not open $sigfile: $!";
+ open D, "< $sigfile" or die "Could not open $sigfile: $!";
}
+ my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
+ my $end = "-----END PGP SIGNATURE-----\n";
while (<D>) {
- next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
- last if /^-----BEGIN PGP SIGNATURE/;
-
+ next if (1 .. ($_ eq $begin));
$signature .= $_;
+ return "$begin$signature" if $_ eq $end;
}
- return ((split(/\n+/, $signature, 2))[1]);
+ return;
}
sub _compare {
my ($str1, $str2, $ok) = @_;
# normalize all linebreaks
+ $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
$str1 =~ s/[^\S ]+/\n/g; $str2 =~ s/[^\S ]+/\n/g;
+ $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
return $ok if $str1 eq $str2;
@@ -305,7 +333,7 @@
}
else {
local (*D, *S);
- open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
+ open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
open D, "| diff -u $SIGNATURE -" or (warn "Could not call diff: $!", return SIGNATURE_MISMATCH);
while (<S>) {
print D $_ if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
@@ -368,9 +396,9 @@
die "Cannot find $sigfile.tmp, signing aborted.\n";
};
- open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
+ open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
- open S, ">$sigfile" or do {
+ open S, "> $sigfile" or do {
unlink "$sigfile.tmp";
die "Could not write to $sigfile: $!";
};
@@ -492,7 +520,7 @@
sub _mkdigest_files {
my $p = shift;
- my $algorithm = shift || $Cipher;
+ my $algorithm = $Cipher;
my $dosnames = (defined(&Dos::UseLFN) && Dos::UseLFN()==0);
my $read = ExtUtils::Manifest::maniread() || {};
my $found = ExtUtils::Manifest::manifind($p);
@@ -531,7 +559,7 @@
}
else {
local *F;
- open F, $file or die "Cannot open $file for reading: $!";
+ open F, "< $file" or die "Cannot open $file for reading: $!";
if (-B $file) {
binmode(F);
$obj->addfile(*F);
|
