30 lines
851 B
Diff
30 lines
851 B
Diff
From 59697efbfe58a2a9c2cc2aba11eca2acb64b27a8 Mon Sep 17 00:00:00 2001
|
|
From: Tony Cook <tony@develop-help.com>
|
|
Date: Thu, 28 Jul 2016 14:18:12 +1000
|
|
Subject: [PATCH] CVE-2016-1238: avoid loading optional modules from default .
|
|
|
|
App::Prove (and hence prove) attempts to load plugins under both
|
|
the App::Prove::Plugin namespace and under the base namespace.
|
|
|
|
If a plugin is only available under the base namespace, and a user runs
|
|
prove from a world-writable directory such as /tmp, an attacker can
|
|
App/Prove/Plugin/PluginName.pm to run code as the user running prove.
|
|
---
|
|
bin/prove | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/bin/prove b/bin/prove
|
|
index 6637cc4..d71b238 100755
|
|
--- a/bin/prove
|
|
+++ b/bin/prove
|
|
@@ -1,5 +1,6 @@
|
|
#!/usr/bin/perl -w
|
|
|
|
+BEGIN { pop @INC if $INC[-1] eq '.' }
|
|
use strict;
|
|
use warnings;
|
|
use App::Prove;
|
|
--
|
|
2.1.4
|
|
|