Avoid loading optional modules from default . (CVE-2016-1238)

Test-Harness-3.36-CVE-2016-1238-avoid-loading-optional-modules-from.patch

@@ -0,0 +1,29 @@
+From 59697efbfe58a2a9c2cc2aba11eca2acb64b27a8 Mon Sep 17 00:00:00 2001
+From: Tony Cook <tony@develop-help.com>
+Date: Thu, 28 Jul 2016 14:18:12 +1000
+Subject: [PATCH] CVE-2016-1238: avoid loading optional modules from default .
+
+App::Prove (and hence prove) attempts to load plugins under both
+the App::Prove::Plugin namespace and under the base namespace.
+
+If a plugin is only available under the base namespace, and a user runs
+prove from a world-writable directory such as /tmp, an attacker can
+App/Prove/Plugin/PluginName.pm to run code as the user running prove.
+---
+ bin/prove | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/bin/prove b/bin/prove
+index 6637cc4..d71b238 100755
+--- a/bin/prove
++++ b/bin/prove
+@@ -1,5 +1,6 @@
+ #!/usr/bin/perl -w
+ 
++BEGIN { pop @INC if $INC[-1] eq '.' }
+ use strict;
+ use warnings;
+ use App::Prove;
+-- 
+2.1.4
+

perl-Test-Harness.spec

@@ -1,11 +1,13 @@
 Name:           perl-Test-Harness
 Version:        3.36
-Release:        366%{?dist}
+Release:        367%{?dist}
 Summary:        Run Perl standard test scripts with statistics
 License:        GPL+ or Artistic
 Group:          Development/Libraries
 URL:            http://search.cpan.org/dist/Test-Harness/
 Source0:        http://www.cpan.org/authors/id/L/LE/LEONT/Test-Harness-%{version}.tar.gz
+# Avoid loading optional modules from default . (CVE-2016-1238)
+Patch0:         Test-Harness-3.36-CVE-2016-1238-avoid-loading-optional-modules-from.patch
 BuildArch:      noarch
 BuildRequires:  coreutils
 BuildRequires:  findutils
@@ -90,6 +92,9 @@ make test
 %{_mandir}/man3/*
 
 %changelog
+* Wed Aug 03 2016 Jitka Plesnikova <jplesnik@redhat.com> - 3.36-367
+- Avoid loading optional modules from default . (CVE-2016-1238)
+
 * Wed May 18 2016 Jitka Plesnikova <jplesnik@redhat.com> - 3.36-366
 - Perl 5.24 re-rebuild of bootstrapped packages