Source: libperlspeak-perl Version: 2.01-2 Severity: grave Tags: security upstream Justification: user security hole Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=132173 Control: tags -1 + stretch buster bullseye sid
Hi, The following vulnerability was published for libperlspeak-perl. CVE-2020-10674[0]: | PerlSpeak through 2.01 allows attackers to execute arbitrary OS | commands, as demonstrated by use of system and 2-argument open. Gregor, the module seem to be basically unmaintained, I would propose to actually remove the package from unstable and likely given there are no reverse dependencies as well from any other suite. What do you think? If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-10674 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10674 [1] https://rt.cpan.org/Public/Bug/Display.html?id=132173 Regards, Salvatore
