Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 05 Jun 2013 11:24:19 -0700
From: Russ Allbery <>
Subject: Re: CVE-2013-2145: perl Module::Signature code execution vulnerability

Vincent Danen <> writes:

> I've suggested to upstream that if they want this to be used seriously
> for trust (and not just verifying that the distribution is untampered
> with, according to whomever was able to sign the SIGNATURE file), that
> they should disable the auto-retrieval of keys by default and/or CPAN
> should manage their own keyserver of trusted keys and cpansign should
> only pull from that keyserver.  The first is probably practical enough
> to do, the second I'm not so sure.

Speaking as a CPAN author, the second would be awesome.  For bonus points,
once one registers a key with CPAN, CPAN could then even check one's
uploads and disallow uploads that aren't signed with the proper key.

It would require work by the CPAN maintainers, but the general
infrastructure is in place to do things like this and one could bootstrap
from CPAN username/password.

Russ Allbery (             <>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.