Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp. Long description: Stephane Chazelas discovered a bug in the environment handling in Perl. Perl provides a Perl-space hash variable, %ENV, in which environment variables can be looked up. If a variable appears twice in envp, only the last value would appear in %ENV, but getenv would return the first. Perl's taint security mechanism would be applied to the value in %ENV, but not to the other rest of the environment. This could result in an ambiguous environment causing environment variables to be propagated to subprocesses, despite the protections supposedly offered by taint checking. Upstream bug: foo Upstream patch: http://perl5.git.perl.org/perl.git/commitdiff/ae37b791a73a9e78dedb89fb2429d2628cf58076
$ git tag --contains ae37b791a73a9e78dedb89fb2429d2628cf58076 | sort -u v5.23.9 v5.24.0 [...] @ Maintainer(s): Can we backport the fix or stabilize 5.24.0 already (yes, I know that we finished stabilization of perl-5.22.3 a few hours ago but I have to ask this)?
Looks like this was fixed in 5.22.2, but with a different commit-id https://perl5.git.perl.org/perl.git/commitdiff/58eaa1131a38c16ee4a66d0bc36288cfde1a39bf git tag --contains 58eaa1131a38c16ee4a66d0bc36288cfde1a39bf v5.22.2 v5.22.2-RC1 v5.22.3 v5.22.3-RC1 v5.22.3-RC2 v5.22.3-RC3 v5.22.3-RC4 v5.22.3-RC5
(In reply to Thomas Deutschmann from comment #0) > Upstream bug: > > foo ?
(In reply to Agostino Sarubbo from comment #3) > (In reply to Thomas Deutschmann from comment #0) > > Upstream bug: > > > > foo https://rt.perl.org/Public/Bug/Display.html?id=127158 Added to existing GLSA.
This issue was resolved and addressed in GLSA 201701-75 at https://security.gentoo.org/glsa/201701-75 by GLSA coordinator Thomas Deutschmann (whissi).
