Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 7 Nov 2017 18:19:04 +0000
From: Simon McVittie <>
Subject: Re: Net::Ping::External command injections

On Tue, 07 Nov 2017 at 17:51:27 +0100, Matthias Weckbecker wrote:
> Net::Ping::External [0] is prone to command injection vulnerabilities.
> The issues are roughly 10 (!) years old [1], but the code is still being
> shipped these days (e.g. in ubuntu artful and debian stretch [2]).

I've reported this to the Debian bug tracking system,

In Ubuntu, libnet-ping-external is in the unsupported 'universe' archive
area, making it unlikely to be fixed there regardless of its status in

> Or drop this pkg. altogether?

For what it's worth, Debian's archive maintenance software says nothing
in unstable, stable or oldstable depends on this package, so there is no
particular barrier to removing it (and bugs in it hopefully only affect
locally-installed scripts, not anything else in Debian).


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.