[Bug 1209917] New: perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Bug ID: 1209917
           Summary: perl-Module-Signature: arbitrary code execution when
                    verifying module signatures
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail]

Module::Signature before version 0.75 used two argument open() calls to read
the files when generating checksums from the signed manifest. This allowed
embedding arbitrary shell commands into the SIGNATURE file that would execute
during the signature verification process.

Upstream fix:
https://github.com/audreyt/module-signature/commit/8a9164596fa5952d4fbcde5aa...
CVE request: http://seclists.org/oss-sec/2015/q2/59

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1209919

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1209920

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1209920
[Bug 1209920] perl-Module-Signature: various flaws [fedora-all]

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Vasyl Kaigorodov  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1209922

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1209922
[Bug 1209922] perl-Module-Signature: various flaws [epel-all]

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

--- Comment #1 from Vasyl Kaigorodov  ---

Created perl-Module-Signature tracking bugs for this issue:

Affects: fedora-all [bug 1209920]
Affects: epel-all [bug 1209922]

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

--- Comment #2 from Fedora Update System  ---
perl-Module-Signature-0.78-1.fc21, perl-Test-Signature-1.11-1.fc21 has been
pushed to the Fedora 21 stable repository.  If problems still persist, please
make note of it in this bug report.

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

--- Comment #3 from Fedora Update System  ---
perl-Test-Signature-1.11-1.fc20, perl-Module-Signature-0.78-1.fc20 has been
pushed to the Fedora 20 stable repository.  If problems still persist, please
make note of it in this bug report.

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

--- Comment #4 from Fedora Update System  ---
perl-Module-Signature-0.78-1.fc22, perl-Test-Signature-1.11-1.fc22 has been
pushed to the Fedora 22 stable repository.  If problems still persist, please
make note of it in this bug report.

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917
Bug 1209917 depends on bug 1209920, which changed state.

Bug 1209920 Summary: perl-Module-Signature: various flaws [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1209920

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |CLOSED
         Resolution|---                         |ERRATA

[Bug 1209917] perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
              Alias|                            |CVE-2015-3408

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Martin Prpic  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|perl-Module-Signature:      |CVE-2015-3408
                   |arbitrary code execution    |perl-Module-Signature:
                   |when verifying module       |arbitrary code execution
                   |signatures                  |when verifying module
                   |                            |signatures

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

--- Comment #5 from Fedora Update System  ---
perl-Test-Signature-1.11-1.el6, perl-Module-Signature-0.78-1.el6 has been
pushed to the Fedora EPEL 6 stable repository.  If problems still persist,
please make note of it in this bug report.

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

--- Comment #6 from Fedora Update System  ---
perl-Test-Signature-1.11-1.el5, perl-Module-Signature-0.78-1.el5 has been
pushed to the Fedora EPEL 5 stable repository.  If problems still persist,
please make note of it in this bug report.

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917
Bug 1209917 depends on bug 1209922, which changed state.

Bug 1209922 Summary: perl-Module-Signature: various flaws [epel-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1209922

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |CLOSED
         Resolution|---                         |ERRATA

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Paul Howarth  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |MODIFIED

--- Comment #7 from Paul Howarth  ---
Fixed in all current Fedora and EPEL releases.

Still to be fixed in RHEL-7.

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Tomas Hoger  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|MODIFIED                    |NEW
   Fixed In Version|Module::Signature 0.75      |perl-Module-Signature 0.75

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Stefan Cornelius  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
                   |0405,reported=20150408,sour |0405,reported=20150408,sour
                   |ce=oss-security,cvss2=5.1/A |ce=oss-security,cvss2=5.1/A
                   |V:N/AC:H/Au:N/C:P/I:P/A:P,f |V:N/AC:H/Au:N/C:P/I:P/A:P,f
                   |edora-all/perl-Module-Signa |edora-all/perl-Module-Signa
                   |ture=affected,epel-all/perl |ture=affected,epel-all/perl
                   |-Module-Signature=affected, |-Module-Signature=affected,
                   |rhel-7/perl-Module-Signatur |rhel-7/perl-Module-Signatur
                   |e=affected                  |e=wontfix

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Stefan Cornelius  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
        Last Closed|                            |2015-08-18 06:01:49

[Bug 1209917] CVE-2015-3408 perl-Module-Signature: arbitrary code execution when verifying module signatures

[Red Hat Bugzilla]

https://bugzilla.redhat.com/show_bug.cgi?id=1209917

Ján Rusnačko  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |[e-mail]
         Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
                   |0405,reported=20150408,sour |0405,reported=20150408,sour
                   |ce=oss-security,cvss2=5.1/A |ce=oss-security,cvss2=5.1/A
                   |V:N/AC:H/Au:N/C:P/I:P/A:P,f |V:N/AC:H/Au:N/C:P/I:P/A:P,f
                   |edora-all/perl-Module-Signa |edora-all/perl-Module-Signa
                   |ture=affected,epel-all/perl |ture=affected,epel-all/perl
                   |-Module-Signature=affected, |-Module-Signature=affected,
                   |rhel-7/perl-Module-Signatur |rhel-7/perl-Module-Signatur
                   |e=wontfix                   |e=wontfix,cwe=CWE-77