Date: Wed, 05 Jun 2013 11:24:19 -0700 From: Russ Allbery <rra@...nford.edu> To: oss-security@...ts.openwall.com Cc: audreyt@...reyt.org Subject: Re: CVE-2013-2145: perl Module::Signature code execution vulnerability Vincent Danen <vdanen@...hat.com> writes: > I've suggested to upstream that if they want this to be used seriously > for trust (and not just verifying that the distribution is untampered > with, according to whomever was able to sign the SIGNATURE file), that > they should disable the auto-retrieval of keys by default and/or CPAN > should manage their own keyserver of trusted keys and cpansign should > only pull from that keyserver. The first is probably practical enough > to do, the second I'm not so sure. Speaking as a CPAN author, the second would be awesome. For bonus points, once one registers a key with CPAN, CPAN could then even check one's uploads and disallow uploads that aren't signed with the proper key. It would require work by the CPAN maintainers, but the general infrastructure is in place to do things like this and one could bootstrap from CPAN username/password. -- Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.