1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
|
Description: Fix CVE-2015-3406, CVE-2015-3407 and CVE-2015-3408
CVE-2015-3406: Module::Signature parses the unsigned portion of the
SIGNATURE file as the signed portion due to incorrect handling of PGP
signature boundaries.
.
CVE-2015-3407: Module::Signature incorrectly handles files that are not
listed in the SIGNATURE file. This includes some files in the t/
directory that would execute when tests are run.
.
CVE-2015-3408: Module::Signature uses two argument open() calls to read
the files when generating checksums from the signed manifest, allowing
to embed arbitrary shell commands into the SIGNATURE file that would
execute during the signature verification process.
Origin: upstream, https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa1c7d1c7bc85372f
Bug-Debian: https://bugs.debian.org/783451
Forwarded: not-needed
Author: Audrey Tang <audreyt@audreyt.org>
Reviewed-by: Salvatore Bonaccorso <carnil@debian.org>
Last-Update: 2015-05-12
Applied-Upstream: 0.75
--- a/Makefile.PL
+++ b/Makefile.PL
@@ -9,6 +9,7 @@ readme_from 'lib/Module/Signature.pm
repository 'http://github.com/audreyt/module-signature';
install_script 'script/cpansign';
build_requires 'Test::More', 0, 'IPC::Run', 0;
+requires 'File::Temp';
# On Win32 (excluding cygwin) we know that IO::Socket::INET,
# which is needed for keyserver stuff, doesn't work. In fact
--- a/lib/Module/Signature.pm
+++ b/lib/Module/Signature.pm
@@ -57,6 +57,8 @@ sub _cipher_map {
my @lines = split /\015?\012/, $sigtext;
my %map;
for my $line (@lines) {
+ last if $line eq '-----BEGIN PGP SIGNATURE-----';
+ next if $line =~ /^---/ .. $line eq '';
my($cipher,$digest,$file) = split " ", $line, 3;
return unless defined $file;
$map{$file} = [$cipher, $digest];
@@ -65,7 +67,7 @@ sub _cipher_map {
}
sub verify {
- my %args = ( skip => 1, @_ );
+ my %args = ( @_ );
my $rv;
(-r $SIGNATURE) or do {
@@ -177,6 +179,11 @@ sub _fullcheck {
($mani, $file) = ExtUtils::Manifest::fullcheck();
}
else {
+ my $_maniskip = &ExtUtils::Manifest::maniskip;
+ local *ExtUtils::Manifest::maniskip = sub { sub {
+ return unless $skip;
+ return $_maniskip->(@_);
+ } };
($mani, $file) = ExtUtils::Manifest::fullcheck();
}
@@ -222,6 +229,11 @@ sub _verify_gpg {
my $keyserver = _keyserver($version);
+ require File::Temp;
+ my $fh = File::Temp->new();
+ print $fh $sigtext;
+ close $fh;
+
my @quiet = $Verbose ? () : qw(-q --logger-fd=1);
my @cmd = (
qw(gpg --verify --batch --no-tty), @quiet, ($KeyServer ? (
@@ -229,7 +241,7 @@ sub _verify_gpg {
($AutoKeyRetrieve and $version ge '1.0.7')
? '--keyserver-options=auto-key-retrieve'
: ()
- ) : ()), $SIGNATURE
+ ) : ()), $fh->filename
);
my $output = '';
@@ -241,6 +253,7 @@ sub _verify_gpg {
my $cmd = join ' ', @cmd;
$output = `$cmd`;
}
+ unlink $fh->filename;
if( $? ) {
print STDERR $output;
@@ -269,7 +282,7 @@ sub _verify_crypt_openpgp {
my $pgp = Crypt::OpenPGP->new(
($KeyServer) ? ( KeyServer => $KeyServer, AutoKeyRetrieve => $AutoKeyRetrieve ) : (),
);
- my $rv = $pgp->handle( Filename => $SIGNATURE )
+ my $rv = $pgp->handle( Data => $sigtext )
or die $pgp->errstr;
return SIGNATURE_BAD if (!$rv->{Validity} and $AutoKeyRetrieve);
@@ -292,32 +305,35 @@ sub _read_sigfile {
my $well_formed;
local *D;
- open D, $sigfile or die "Could not open $sigfile: $!";
+ open D, "< $sigfile" or die "Could not open $sigfile: $!";
if ($] >= 5.006 and <D> =~ /\r/) {
close D;
- open D, $sigfile or die "Could not open $sigfile: $!";
+ open D, '<', $sigfile or die "Could not open $sigfile: $!";
binmode D, ':crlf';
} else {
close D;
- open D, $sigfile or die "Could not open $sigfile: $!";
+ open D, "< $sigfile" or die "Could not open $sigfile: $!";
}
+ my $begin = "-----BEGIN PGP SIGNED MESSAGE-----\n";
+ my $end = "-----END PGP SIGNATURE-----\n";
while (<D>) {
- next if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
- last if /^-----BEGIN PGP SIGNATURE/;
-
+ next if (1 .. ($_ eq $begin));
$signature .= $_;
+ return "$begin$signature" if $_ eq $end;
}
- return ((split(/\n+/, $signature, 2))[1]);
+ return;
}
sub _compare {
my ($str1, $str2, $ok) = @_;
# normalize all linebreaks
+ $str1 =~ s/^-----BEGIN PGP SIGNED MESSAGE-----\n(?:.+\n)*\n//;
$str1 =~ s/[^\S ]+/\n/g; $str2 =~ s/[^\S ]+/\n/g;
+ $str1 =~ s/-----BEGIN PGP SIGNATURE-----\n(?:.+\n)*$//;
return $ok if $str1 eq $str2;
@@ -328,7 +344,7 @@ sub _compare {
}
else {
local (*D, *S);
- open S, $SIGNATURE or die "Could not open $SIGNATURE: $!";
+ open S, "< $SIGNATURE" or die "Could not open $SIGNATURE: $!";
open D, "| diff -u $SIGNATURE -" or (warn "Could not call diff: $!", return SIGNATURE_MISMATCH);
while (<S>) {
print D $_ if (1 .. /^-----BEGIN PGP SIGNED MESSAGE-----/);
@@ -391,9 +407,9 @@ sub _sign_gpg {
die "Cannot find $sigfile.tmp, signing aborted.\n";
};
- open D, "$sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
+ open D, "< $sigfile.tmp" or die "Cannot open $sigfile.tmp: $!";
- open S, ">$sigfile" or do {
+ open S, "> $sigfile" or do {
unlink "$sigfile.tmp";
die "Could not write to $sigfile: $!";
};
@@ -576,7 +592,7 @@ sub _mkdigest_files {
}
else {
local *F;
- open F, $file or die "Cannot open $file for reading: $!";
+ open F, "< $file" or die "Cannot open $file for reading: $!";
if (-B $file) {
binmode(F);
$obj->addfile(*F);
|
