Bug#644108: unsafe use of eval in Digest->new()

2011-10-03 Thread Dominic Hargreaves
severity 644108 important thanks On Mon, Oct 03, 2011 at 12:39:38PM +0200, Ansgar Burchardt wrote: > there will be no DSA for this issue. Okay, I assume this means that a severity downgrade is in order. I'm not yet convined that the effort and risk of a squeeze and lenny release of perl is justif

Bug#644108: unsafe use of eval in Digest->new()

2011-10-03 Thread Dominic Hargreaves
On Mon, Oct 03, 2011 at 04:01:50PM +0200, Moritz Mühlenhoff wrote: > perl-modules from Squeeze also contains 1.16, just like libdigest-perl. > What's the purpose of this package, then? > > Wouldn't it rather make sense to drop standalone packages for all > modules present in perl-modules? Where

Bug#644108: unsafe use of eval in Digest->new()

2011-10-03 Thread Moritz Mühlenhoff
On Sun, Oct 02, 2011 at 11:44:39PM +0200, Ansgar Burchardt wrote: > Package: perl > Version: 5.10.0-19 > Severity: grave > Tags: security upstream > > Hi, > > the last upstream release of libdigest-perl (1.17) contains a fix for an > unsafe use of eval: the argument to Digest->new($algo) was not

Bug#644108: unsafe use of eval in Digest->new()

2011-10-03 Thread Ansgar Burchardt
Hi, there will be no DSA for this issue. Regards, Ansgar -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#644108: unsafe use of eval in Digest->new()

2011-10-02 Thread Ansgar Burchardt
Package: perl Version: 5.10.0-19 Severity: grave Tags: security upstream Hi, the last upstream release of libdigest-perl (1.17) contains a fix for an unsafe use of eval: the argument to Digest->new($algo) was not checked properly allowing code injection (in case the value can be changed by the at