Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 606750 (CVE-2016-2381)

Summary: <dev-lang/perl-5.22.2: ambiguous environment variables handling
Product: Gentoo Security Reporter: Thomas Deutschmann <whissi>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: minor CC: kentnl, perl
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B3 [glsa cve]
Package list:
Runtime testing required: ---

Description Thomas Deutschmann gentoo-dev 2017-01-22 01:14:46 UTC
Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.

Long description:

Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking.

Upstream bug:


Upstream patch:
Comment 1 Thomas Deutschmann gentoo-dev 2017-01-22 01:19:49 UTC
$ git tag --contains ae37b791a73a9e78dedb89fb2429d2628cf58076 | sort -u

@ Maintainer(s): Can we backport the fix or stabilize 5.24.0 already (yes, I know that we finished stabilization of perl-5.22.3 a few hours ago but I have to ask this)?
Comment 2 Kent Fredric (IRC: kent\n) (RETIRED) gentoo-dev 2017-01-22 03:10:36 UTC
Looks like this was fixed in 5.22.2, but with a different commit-id

git tag --contains 58eaa1131a38c16ee4a66d0bc36288cfde1a39bf

Comment 3 Agostino Sarubbo gentoo-dev 2017-01-22 14:26:00 UTC
(In reply to Thomas Deutschmann from comment #0)
> Upstream bug:
> foo

Comment 4 Thomas Deutschmann gentoo-dev 2017-01-29 23:27:10 UTC
(In reply to Agostino Sarubbo from comment #3)
> (In reply to Thomas Deutschmann from comment #0)
> > Upstream bug:
> > 
> > foo

Added to existing GLSA.
Comment 5 GLSAMaker/CVETool Bot gentoo-dev 2017-01-29 23:46:01 UTC
This issue was resolved and addressed in
 GLSA 201701-75 at
by GLSA coordinator Thomas Deutschmann (whissi).