From d850417e1a54260e62202249ec9ba5fcddd5b12f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Wed, 14 Oct 2020 14:36:46 +0200 Subject: [PATCH] 1.19 bump --- .gitignore | 1 + ...event-loading-optional-modules-from-.patch | 41 ------------------- perl-Digest.spec | 35 ++++++++-------- sources | 2 +- 4 files changed, 20 insertions(+), 59 deletions(-) delete mode 100644 Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch diff --git a/.gitignore b/.gitignore index 77d9f5f..7efe963 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1,2 @@ /Digest-1.17.tar.gz +/Digest-1.19.tar.gz diff --git a/Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch b/Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch deleted file mode 100644 index 5552a4b..0000000 --- a/Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 8cfc4916736280dd76655fdef5b78331bfac414d Mon Sep 17 00:00:00 2001 -From: Tony Cook -Date: Wed, 27 Jul 2016 14:04:59 +1000 -Subject: [PATCH] CVE-2016-1238: prevent loading optional modules from default - . - -Digest attempts to load Digest::SHA, only failing if Digest::SHA2 -is also unavailable. - -If a system has Digest installed, but not Digest::SHA, and a user -attempts to run a program using Digest with SHA-256 from a world -writable directory such as /tmp and since perl adds "." to the end -of @INC an attacker can run code as the original user by creating -/tmp/Digest/SHA.pm. - -The change temporarily removes the default "." entry from the end of -@INC preventing that attack. ---- - Digest.pm | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/Digest.pm b/Digest.pm -index 2ae6eec..c75649f 100644 ---- a/Digest.pm -+++ b/Digest.pm -@@ -42,7 +42,11 @@ sub new - unless (exists ${"$class\::"}{"VERSION"}) { - my $pm_file = $class . ".pm"; - $pm_file =~ s{::}{/}g; -- eval { require $pm_file }; -+ eval { -+ local @INC = @INC; -+ pop @INC if $INC[-1] eq '.'; -+ require $pm_file; -+ }; - if ($@) { - $err ||= $@; - next; --- -2.1.4 - diff --git a/perl-Digest.spec b/perl-Digest.spec index 12a9ba2..8b3c019 100644 --- a/perl-Digest.spec +++ b/perl-Digest.spec @@ -1,23 +1,25 @@ Name: perl-Digest -Version: 1.17 -Release: 457%{?dist} +Version: 1.19 +Release: 1%{?dist} Summary: Modules that calculate message digests License: GPL+ or Artistic URL: https://metacpan.org/release/Digest -Source0: https://cpan.metacpan.org/authors/id/G/GA/GAAS/Digest-%{version}.tar.gz -# Avoid loading optional modules from default . (CVE-2016-1238) -Patch0: Digest-0.17-CVE-2016-1238-prevent-loading-optional-modules-from-.patch +Source0: https://cpan.metacpan.org/authors/id/T/TO/TODDR/Digest-%{version}.tar.gz BuildArch: noarch BuildRequires: coreutils -BuildRequires: findutils BuildRequires: make BuildRequires: perl-interpreter BuildRequires: perl-generators +BuildRequires: perl(:VERSION) >= 5.6 +BuildRequires: perl(ExtUtils::MakeMaker) >= 6.76 +BuildRequires: perl(strict) +BuildRequires: perl(warnings) +# Run-time: BuildRequires: perl(Carp) BuildRequires: perl(Exporter) -BuildRequires: perl(ExtUtils::MakeMaker) BuildRequires: perl(MIME::Base64) # Tests only: +BuildRequires: perl(File::Temp) BuildRequires: perl(lib) BuildRequires: perl(Test::More) >= 0.47 Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) @@ -25,24 +27,20 @@ Requires: perl(MIME::Base64) %description The Digest:: modules calculate digests, also called "fingerprints" or -"hashes", of some data, called a message. The digest is (usually) -some small/fixed size string. The actual size of the digest depend of -the algorithm used. The message is simply a sequence of arbitrary -bytes or bits. +"hashes", of some data, called a message. The digest is (usually) some +small/fixed size string. The actual size of the digest depends of the +algorithm used. The message is simply a sequence of arbitrary bytes or bits. %prep %setup -q -n Digest-%{version} -%patch0 -p1 chmod -x digest-bench %build -%{__perl} Makefile.PL INSTALLDIRS=vendor -make %{?_smp_mflags} +perl Makefile.PL INSTALLDIRS=vendor NO_PACKLIST=1 NO_PERLLOCAL=1 +%{make_build} %install -make pure_install PERL_INSTALL_ROOT=$RPM_BUILD_ROOT -find $RPM_BUILD_ROOT -type f -name .packlist -exec rm -f {} \; -find $RPM_BUILD_ROOT -depth -type d -exec rmdir {} 2>/dev/null \; +%{make_install} %{_fixperms} $RPM_BUILD_ROOT/* %check @@ -54,6 +52,9 @@ make test %{_mandir}/man3/* %changelog +* Wed Oct 14 2020 Petr Pisar - 1.19-1 +- 1.19 bump + * Tue Jul 28 2020 Fedora Release Engineering - 1.17-457 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild diff --git a/sources b/sources index 83486bb..8067af5 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (Digest-1.17.tar.gz) = 2465f29a5d2fee9b8a9adbe7cf02541966a52d502fbb77392ec9839c8132c2f4499d2c47140316f2a1315dccc4d32f251056e02ce46b358632abb406c9197366 +SHA512 (Digest-1.19.tar.gz) = 97eb738d64571abdcf3cec74479e5bdebbdb4f9658ff483de863fdf47aac1a3d32c10f9ecc52bc58f6041da26e92254cec9fd5a76a3b1c2d96b406ccf48add93