[Bug 1877444] New: perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444

            Bug ID: 1877444
           Summary: perl-dbi: DBD::File drivers open files from folders
                    other than specifically passed
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: psampaio(a)redhat.com
                CC: caillon+fedoraproject(a)gmail.com, hhorak(a)redhat.com,
                    john.j5live(a)gmail.com, jorton(a)redhat.com,
                    jplesnik(a)redhat.com, kasal(a)ucw.cz,
                    perl-devel(a)lists.fedoraproject.org,
                    perl-maint-list(a)redhat.com, ppisar(a)redhat.com,
                    rhughes(a)redhat.com, rstrode(a)redhat.com,
                    sandmann(a)redhat.com
  Target Milestone: ---
    Classification: Other




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444

Pedro Sampaio <psampaio(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1857388



A flaw was foundin perl-dbi before version. DBD::File drivers would open files
from folders other than specifically passed using the f_dir attribute.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/caedc0d7d602f5b2ae5efc1b00f39efea...


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444



--- Comment #1 from Petr Pisar <ppisar(a)redhat.com&gt; ---
The fix was released by upstream in DBI-1.632.


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444

Todd Cullum <tcullum(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1877964




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444



--- Comment #4 from Todd Cullum <tcullum(a)redhat.com&gt; ---
External References:

Advisory:
https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.632-9t...


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] CVE-2014-10401 perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444

Todd Cullum <tcullum(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|perl-dbi: DBD::File drivers |CVE-2014-10401 perl-dbi:
                   |open files from folders     |DBD::File drivers open
                   |other than specifically     |files from folders other
                   |passed                      |than specifically passed
              Alias|                            |CVE-2014-10401




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] CVE-2014-10401 perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444



--- Comment #5 from Todd Cullum <tcullum(a)redhat.com&gt; ---
Statement:

perl-DBI as shipped in Red Hat Enterprise Linux 8, rhscl-3 rh-perl526-perl-DBI
and rhscl-3 rh-perl530-perl-DBI are notaffected by this flaw as the vulnerable
code has already been patched in versions of perl-DBI shipped in these
products.


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] CVE-2014-10401 perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444



--- Comment #6 from Todd Cullum <tcullum(a)redhat.com&gt; ---
External References:

Advisory:
https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.632-9t...
Upstream Bug: https://rt.cpan.org/Public/Bug/Display.html?id=99508


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877444] CVE-2014-10401 perl-dbi: DBD::File drivers open files from folders other than specifically passed

https://bugzilla.redhat.com/show_bug.cgi?id=1877444

Todd Cullum <tcullum(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |WONTFIX
             Status|NEW                         |CLOSED
        Last Closed|                            |2021-11-02 17:38:46




-- 
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=1877444