[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20171107181904.eu7gdgk43bdacvot@perpetual.pseudorandom.co.uk>
Date: Tue, 7 Nov 2017 18:19:04 +0000
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Net::Ping::External command injections
On Tue, 07 Nov 2017 at 17:51:27 +0100, Matthias Weckbecker wrote:
> Net::Ping::External [0] is prone to command injection vulnerabilities.
>
> The issues are roughly 10 (!) years old [1], but the code is still being
> shipped these days (e.g. in ubuntu artful and debian stretch [2]).
I've reported this to the Debian bug tracking system,
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=881097
In Ubuntu, libnet-ping-external is in the unsupported 'universe' archive
area, making it unlikely to be fixed there regardless of its status in
Debian.
> Or drop this pkg. altogether?
For what it's worth, Debian's archive maintenance software says nothing
in unstable, stable or oldstable depends on this package, so there is no
particular barrier to removing it (and bugs in it hopefully only affect
locally-installed scripts, not anything else in Debian).
smcv
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
