commit 3d177ad2c43908ce407a1bca5de3be0569ed7041
Author: Petr Písař <ppisar@xxxxxxxxxx>
Date: Mon May 12 14:35:25 2014 +0200
Fix CVE-2014-3230
...76-don-t-disale-verification-if-only-host.patch | 30 +++++++++++++++
...76-fix-test-make-it-workable-for-Crypt-SS.patch | 38 ++++++++++++++++++++
perl-LWP-Protocol-https.spec | 14 +++++++-
3 files changed, 81 insertions(+), 1 deletions(-)
---
diff --git a/LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch b/LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch
new file mode 100644
index 0000000..876e719
--- /dev/null
+++ b/LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch
@@ -0,0 +1,30 @@
+From 891f28d04e1130de506199b7a75373d55f61db6f Mon Sep 17 00:00:00 2001
+From: Steffen Ullrich <Steffen_Ullrich@xxxxxxxx>
+Date: Sat, 3 May 2014 23:04:36 +0200
+Subject: [PATCH 1/2] Debian #746576 - don't disale verification if only
+ hostnames should not be verified
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar@xxxxxxxxxx>
+---
+ lib/LWP/Protocol/https.pm | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/LWP/Protocol/https.pm b/lib/LWP/Protocol/https.pm
+index f7230e2..f39422a 100644
+--- a/lib/LWP/Protocol/https.pm
++++ b/lib/LWP/Protocol/https.pm
+@@ -20,7 +20,7 @@ sub _extra_sock_opts
+ $ssl_opts{SSL_verifycn_scheme} = 'www';
+ }
+ else {
+- $ssl_opts{SSL_verify_mode} = 0;
++ $ssl_opts{SSL_verifycn_scheme} = 'none';
+ }
+ if ($ssl_opts{SSL_verify_mode}) {
+ unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
+--
+1.9.0
+
diff --git a/LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch b/LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch
new file mode 100644
index 0000000..90e6011
--- /dev/null
+++ b/LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch
@@ -0,0 +1,38 @@
+From bc4478cb7fb9037418af8415fe1175332697bf72 Mon Sep 17 00:00:00 2001
+From: Steffen Ullrich <Steffen_Ullrich@xxxxxxxx>
+Date: Sun, 4 May 2014 09:14:13 +0200
+Subject: [PATCH 2/2] Debian #746576 - fix test, make it workable for
+ Crypt::SSLeay/Net::SSL too
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Petr Písař <ppisar@xxxxxxxxxx>
+
+Petr Pisar: Ported to 6.04.
+
+Signed-off-by: Petr Písař <ppisar@xxxxxxxxxx>
+---
+ lib/LWP/Protocol/https.pm | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/lib/LWP/Protocol/https.pm b/lib/LWP/Protocol/https.pm
+index f39422a..73020dc 100644
+--- a/lib/LWP/Protocol/https.pm
++++ b/lib/LWP/Protocol/https.pm
+@@ -20,7 +20,11 @@ sub _extra_sock_opts
+ $ssl_opts{SSL_verifycn_scheme} = 'www';
+ }
+ else {
+- $ssl_opts{SSL_verifycn_scheme} = 'none';
++ if ( $Net::HTTPS::SSL_SOCKET_CLASS eq 'Net::SSL' ) {
++ $ssl_opts{SSL_verifycn_scheme} = '';
++ } else {
++ $ssl_opts{SSL_verifycn_scheme} = 'none';
++ }
+ }
+ if ($ssl_opts{SSL_verify_mode}) {
+ unless (exists $ssl_opts{SSL_ca_file} || exists $ssl_opts{SSL_ca_path}) {
+--
+1.9.0
+
diff --git a/perl-LWP-Protocol-https.spec b/perl-LWP-Protocol-https.spec
index 0544ad2..3e1f475 100644
--- a/perl-LWP-Protocol-https.spec
+++ b/perl-LWP-Protocol-https.spec
@@ -1,11 +1,17 @@
Name: perl-LWP-Protocol-https
Version: 6.04
-Release: 3%{?dist}
+Release: 4%{?dist}
Summary: Provide HTTPS support for LWP::UserAgent
License: GPL+ or Artistic
Group: Development/Libraries
URL: http://search.cpan.org/dist/LWP-Protocol-https/
Source0: http://www.cpan.org/authors/id/G/GA/GAAS/LWP-Protocol-https-%{version}.tar.gz
+# Fix CVE-2014-3230, bug #1094442,
+# proposed in https://github.com/libwww-perl/lwp-protocol-https/pull/14
+Patch0: LWP-Protocol-https-6.04-Debian-746576-don-t-disale-verification-if-only-host.patch
+# Fix CVE-2014-3230, bug #1094442,
+# proposed in https://github.com/libwww-perl/lwp-protocol-https/pull/14
+Patch1: LWP-Protocol-https-6.04-Debian-746576-fix-test-make-it-workable-for-Crypt-SS.patch
BuildArch: noarch
BuildRequires: perl(ExtUtils::MakeMaker)
# Run-requires
@@ -32,6 +38,8 @@ access sites using HTTP over SSL/TLS.
%prep
%setup -q -n LWP-Protocol-https-%{version}
+%patch0 -p1
+%patch1 -p1
%build
%{__perl} Makefile.PL INSTALLDIRS=vendor
@@ -52,6 +60,10 @@ make test
%{_mandir}/man3/*
%changelog
+* Mon May 12 2014 Petr Pisar <ppisar@xxxxxxxxxx> - 6.04-4
+- Fix CVE-2014-3230 (incorrect handling of SSL certificate verification if
+ HTTPS_CA_DIR or HTTPS_CA_FILE environment variables are set) (bug #1094442)
+
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@xxxxxxxxxxxxxxxxxxxxxxx> - 6.04-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
--
Fedora Extras Perl SIG
http://www.fedoraproject.org/wiki/Extras/SIGs/Perl
perl-devel mailing list
perl-devel@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/perl-devel
