Skip Menu |
 

This queue is for tickets about the JSON-PP CPAN distribution.

Report information
The Basics
Id: 116539
Status: resolved
Priority: 0/
Queue: JSON-PP

People
Owner: Nobody in particular
Requestors: TONYC [...] cpan.org
Cc:
AdminCc:

Bug Information
Severity: (no value)
Broken in: (no value)
Fixed in: (no value)

Attachments
0001-CVE-2016-1238-avoid-loading-optional-modules-from-de.patch



Subject: CVE-2016-1238: avoid loading optional modules from default .
Download (untitled) / with headers
text/plain 491b
JSON::PP treats Scalar::Util as optional and may load Encode, which treats Encode::ConfigLocal as optional. With the default . in @INC, and if Encode::ConfigLocal is not in the default locations, an attacker can create for example /tmp/Encode/ConfigLocal.pm, and if a process using JSON::PP is started from /tmp, perl will run the attacker's code. The change to json_pp is purely precautionary. Patch also available as a pull request at: https://github.com/makamaka/JSON-PP/pull/25 Tony
Subject: 0001-CVE-2016-1238-avoid-loading-optional-modules-from-de.patch
From 869cca1a100a1081676f17a3af95457fc3f146cb Mon Sep 17 00:00:00 2001 From: Tony Cook <tony@develop-help.com> Date: Thu, 28 Jul 2016 11:16:43 +1000 Subject: [PATCH] CVE-2016-1238: avoid loading optional modules from default . JSON::PP treats Scalar::Util as optional and may load Encode, which treats Encode::ConfigLocal as optional. With the default . in @INC, and if Encode::ConfigLocal is not in the default locations, an attacker can create for example /tmp/Encode/ConfigLocal.pm, and if a process using JSON::PP is started from /tmp, perl will run the attacker's code. The change to json_pp is purely precautionary. The changes to JSON:PP were not included in the recent security patches since Scalar::Util is always available, and Encode was patched to prevent the problem there. --- bin/json_pp | 1 + lib/JSON/PP.pm | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/bin/json_pp b/bin/json_pp index 3362dec..39bed4d 100644 --- a/bin/json_pp +++ b/bin/json_pp @@ -1,5 +1,6 @@ #!/usr/bin/perl +BEGIN { pop @INC if $INC[-1] eq '.' } use strict; use Getopt::Long; diff --git a/lib/JSON/PP.pm b/lib/JSON/PP.pm index 2d27e78..555f6fc 100644 --- a/lib/JSON/PP.pm +++ b/lib/JSON/PP.pm @@ -1271,6 +1271,8 @@ sub _decode_unicode { BEGIN { unless ( defined &utf8::is_utf8 ) { + local @INC = @INC; + pop @INC if $INC[-1] eq '.'; require Encode; *utf8::is_utf8 = *Encode::is_utf8; } @@ -1332,6 +1334,8 @@ BEGIN { # BEGIN { + local @INC = @INC; + pop @INC if $INC[-1] eq '.'; eval 'require Scalar::Util'; unless($@){ *JSON::PP::blessed = \&Scalar::Util::blessed; -- 2.1.4
Download (untitled) / with headers
text/plain 581b
On Thu Jul 28 10:18:37 2016, TONYC wrote: Show quoted text
> JSON::PP treats Scalar::Util as optional and may load Encode, which > treats Encode::ConfigLocal as optional. > > With the default . in @INC, and if Encode::ConfigLocal is not in > the default locations, an attacker can create for example > /tmp/Encode/ConfigLocal.pm, and if a process using JSON::PP is started > from /tmp, perl will run the attacker's code. > > The change to json_pp is purely precautionary. > > Patch also available as a pull request at: > > https://github.com/makamaka/JSON-PP/pull/25 > > Tony
Thanks. Applied.
Download (untitled) / with headers
text/plain 700b
On Sat Aug 27 23:15:02 2016, ISHIGAKI wrote: Show quoted text
> On Thu Jul 28 10:18:37 2016, TONYC wrote:
> > JSON::PP treats Scalar::Util as optional and may load Encode, which > > treats Encode::ConfigLocal as optional. > > > > With the default . in @INC, and if Encode::ConfigLocal is not in > > the default locations, an attacker can create for example > > /tmp/Encode/ConfigLocal.pm, and if a process using JSON::PP is started > > from /tmp, perl will run the attacker's code. > > > > The change to json_pp is purely precautionary. > > > > Patch also available as a pull request at: > > > > https://github.com/makamaka/JSON-PP/pull/25 > > > > Tony
> > Thanks. Applied.
Closed as 2.92 was released. Thanks.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.