[perl-LWP-Protocol-https/f20] Fix CVE-2014-3230

[Petr Pisar]

commit 3d177ad2c43908ce407a1bca5de3be0569ed7041
Author: Petr Písař <ppisar at redhat.com>
Date:   Mon May 12 14:35:25 2014 +0200

    Fix CVE-2014-3230

 ...76-don-t-disale-verification-if-only-host.patch |   30 +++++++++++++++
 ...76-fix-test-make-it-workable-for-Crypt-SS.patch |   38 ++++++++++++++++++++
 perl-LWP-Protocol-https.spec                       |   14 +++++++-
 3 files changed, 81 insertions(+), 1 deletions(-)
---
diff --git a/LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch b/LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch
new file mode 100644
index 0000000..876e719
--- /dev/null
+++ b/LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch
@@ -0,0 +1,30 @@
+From 891f28d04e1130de506199b7a75373d55f61db6f Mon Sep 17 00:00:00 2001
+From: Steffen Ullrich <Steffen_Ullrich at genua.de>
+Date: Sat, 3 May 2014 23:04:36 +0200
+Subject: [PATCH 1/2] Debian #746576 - don't disale verification if only
+ hostnames should not be verified
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar at redhat.com>
+---
+ lib/LWP/Protocol/https.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/LWP/Protocol/https.pm b/lib/LWP/Protocol/https.pm
+index f7230e2..f39422a 100644
+--- a/lib/LWP/Protocol/https.pm
++++ b/lib/LWP/Protocol/https.pm
+@@ -20,7 +20,7 @@ sub _extra_sock_opts
+ 	$ssl_opts{SSL_verifycn_scheme} = 'www';
+     }
+     else {
+-	$ssl_opts{SSL_verify_mode} = 0;
++	$ssl_opts{SSL_verifycn_scheme} = 'none';
+     }
+     if ($ssl_opts{SSL_verify_mode}) {
+ 	unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
+-- 
+1.9.0
+
diff --git a/LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch b/LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch
new file mode 100644
index 0000000..90e6011
--- /dev/null
+++ b/LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch
@@ -0,0 +1,38 @@
+From bc4478cb7fb9037418af8415fe1175332697bf72 Mon Sep 17 00:00:00 2001
+From: Steffen Ullrich <Steffen_Ullrich at genua.de>
+Date: Sun, 4 May 2014 09:14:13 +0200
+Subject: [PATCH 2/2] Debian #746576 - fix test, make it workable for
+ Crypt::SSLeay/Net::SSL too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar at redhat.com>
+
+Petr Pisar: Ported to 6.04.
+
+Signed-off-by: Petr Písař <ppisar at redhat.com>
+---
+ lib/LWP/Protocol/https.pm | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/lib/LWP/Protocol/https.pm b/lib/LWP/Protocol/https.pm
+index f39422a..73020dc 100644
+--- a/lib/LWP/Protocol/https.pm
++++ b/lib/LWP/Protocol/https.pm
+@@ -20,7 +20,11 @@ sub _extra_sock_opts
+ 	$ssl_opts{SSL_verifycn_scheme} = 'www';
+     }
+     else {
+-	$ssl_opts{SSL_verifycn_scheme} = 'none';
++	if ( $Net::HTTPS::SSL_SOCKET_CLASS eq 'Net::SSL' ) {
++	    $ssl_opts{SSL_verifycn_scheme} = '';
++	} else {
++	    $ssl_opts{SSL_verifycn_scheme} = 'none';
++	}
+     }
+     if ($ssl_opts{SSL_verify_mode}) {
+ 	unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
+-- 
+1.9.0
+
diff --git a/perl-LWP-Protocol-https.spec b/perl-LWP-Protocol-https.spec
index 0544ad2..3e1f475 100644
--- a/perl-LWP-Protocol-https.spec
+++ b/perl-LWP-Protocol-https.spec
@@ -1,11 +1,17 @@
 Name:           perl-LWP-Protocol-https
 Version:        6.04
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        Provide HTTPS support for LWP::UserAgent
 License:        GPL+ or Artistic
 Group:          Development/Libraries
 URL:            http://search.cpan.org/dist/LWP-Protocol-https/
 Source0:        http://www.cpan.org/authors/id/G/GA/GAAS/LWP-Protocol-https-%{version}.tar.gz
+# Fix CVE-2014-3230, bug #1094442,
+# proposed in https://github.com/libwww-perl/lwp-protocol-https/pull/14
+Patch0:         LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch
+# Fix CVE-2014-3230, bug #1094442,
+# proposed in https://github.com/libwww-perl/lwp-protocol-https/pull/14
+Patch1:         LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch
 BuildArch:      noarch
 BuildRequires:  perl(ExtUtils::MakeMaker)
 # Run-requires
@@ -32,6 +38,8 @@ access sites using HTTP over SSL/TLS.
 
 %prep
 %setup -q -n LWP-Protocol-https-%{version}
+%patch0 -p1
+%patch1 -p1
 
 %build
 %{__perl} Makefile.PL INSTALLDIRS=vendor
@@ -52,6 +60,10 @@ make test
 %{_mandir}/man3/*
 
 %changelog
+* Mon May 12 2014 Petr Pisar <ppisar at redhat.com> - 6.04-4
+- Fix CVE-2014-3230 (incorrect handling of SSL certificate verification if
+  HTTPS_CA_DIR or HTTPS_CA_FILE environment variables are set) (bug #1094442)
+
 * Sat Aug 03 2013 Fedora Release Engineering <rel-eng at lists.fedoraproject.org> - 6.04-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild