Hmm. I'm not convinced.

bugbot adjusting priority

Notes from brief discussion with maintainer:

The upstream patch only updates the @INC path in various perl commands. As such it is understood to only cover the commands included with the perl package, not not any system command implemented in perl.

As such it would seem that the @INC issue affects all system commands implemented in perl, but these would each need to be fixed separately.

seems public

http://www.nntp.perl.org/group/perl.perl5.porters/2016/07/msg238271.html

Steve Hay just pushed fixes for CVE-2016-1238 to maint-5.22 and
maint-5.24 for:
https://rt.perl.org/Ticket/Display.html?id=127834

Steve has also just released RCs for 5.22.3 and 5.24.1 carrying these fixes:

http://nntp.perl.org/group/perl.perl5.porters/238269
http://nntp.perl.org/group/perl.perl5.porters/238270


The problem relates to Perl 5 ("perl") loading modules from the includes
directory array ("@INC") in which the last element is the current
directory ("."). For more information, see the RT ticket linked above.

While the Perl Security group has attempted to mitigate some of these
problems by modifying Perl Modules, it is ultimately the responsibility
of the application writer to remove relative paths from @INC to assure
the security / consistent behavior of their code regardless of what
directory it executes from.

The fix is to check if the last entry of @INC is "." and if so, to
remove it as an included path.

The following line, when added to the top of Perl applications, should
mitigate this problem. This assumes your code is not intentionally
depending on paths relative to your current working directory:

    BEGIN { pop @INC if $INC[-1] eq '.' }

We would also like to discourage using relative paths in @INC.

This problem was first reported by John Lightsey and Todd Rinaldo,
courtesy of the cPanel Security Team at cPanel. The CVE is courtesy of
Debian. The fix was done by Tony Cook.

-- Sawyer X, p5p.

This is the blurb from perldelta. Please include in the patchinfo doc.

Core modules and tools no longer search "." for optional modules

The tools and many modules supplied in core no longer search the default
current directory entry in @INC for optional modules.  For 
example, Storable will remove the final "." from @INC before trying to
load Log::Agent.

This prevents an attacker injecting an optional module into a process run by
another user where the current directory is writable by the attacker, e.g. the 
/tmp directory.

In most cases this removal should not cause problems, the exception being
the "base" module.

The "base" module treats every module name supplied as optional.  If you have
applications that use base to load non-optional modules from the current
directory you will need to modify your code or environment.

If your code always trusts the contents of the current directory, the simplest
change is adding "." to PERL5LIB:

  # for Bourne shell and similar
  set PERL5LIB=.
  export PERL5LIB

If you do not trust the current directory this will open your code up to
attacks on any module load, not just optional modules.  You may want to add the 
absolute path of your application's module directory to PERL5LIB instead.

Alternatively, you can change your code, either to add the directory with your
binary to @INC:

  use FindBin;
  use lib $FindBin::Bin;

or switch to the "parent" module, which requires an explicit parameter for optional
modules:

  use parent 'Nonoptional::Module';

though this will have the same problem if the current directory is removed from
@INC in Perl 5.26.

Also, since base now localizes @INC when loading modules, changes to
@INC in the loaded module will be discarded when @INC is restored to its 
previous value.

I've come up with a different patch for base.pm that isn't so likely to break things. I've asked upstream what they think about it, let's see what the respond.

So it's likaly that I'll resubmit the updates.

OK, resubmitted with a new patch.

Somebody already accepted the old requests, please make sure that they are not used.

SUSE-SU-2016:2246-1: An update that fixes four vulnerabilities is now available.

Category: security (moderate)
Bug References: 929027,967082,987887,988311
CVE References: CVE-2015-8853,CVE-2016-1238,CVE-2016-2381,CVE-2016-6185
Sources used:
SUSE Linux Enterprise Software Development Kit 11-SP4 (src):    perl-5.10.0-64.80.1
SUSE Linux Enterprise Server 11-SP4 (src):    perl-5.10.0-64.80.1
SUSE Linux Enterprise Debuginfo 11-SP4 (src):    perl-5.10.0-64.80.1

SUSE-SU-2016:2263-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 928292,932894,967082,984906,987887,988311
CVE References: CVE-2015-8853,CVE-2016-1238,CVE-2016-2381,CVE-2016-6185
Sources used:
SUSE Linux Enterprise Server 12-SP1 (src):    perl-5.18.2-11.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    perl-5.18.2-11.1

openSUSE-SU-2016:2313-1: An update that solves four vulnerabilities and has two fixes is now available.

Category: security (moderate)
Bug References: 928292,932894,967082,984906,987887,988311
CVE References: CVE-2015-8853,CVE-2016-1238,CVE-2016-2381,CVE-2016-6185
Sources used:
openSUSE Leap 42.1 (src):    perl-5.18.2-5.1

An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2018-07-10.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/64075

SpamAssassin is also affected by this -> https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c@%3Cannounce.apache.org%3E

I've split off a bug for spamassassin -> bug#1108749

SUSE-SU-2019:0505-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 1123389,987887
CVE References: CVE-2016-1238
Sources used:
SUSE Linux Enterprise Module for Basesystem 15 (src):    amavisd-new-2.11.1-6.3.1

openSUSE-SU-2019:0297-1: An update that solves one vulnerability and has one errata is now available.

Category: security (moderate)
Bug References: 1123389,987887
CVE References: CVE-2016-1238
Sources used:
openSUSE Leap 15.0 (src):    amavisd-new-2.11.1-lp150.5.3.1

Released.