| Subject: | Security: shell injection RCEs all over the place |
| Date: | Wed, 18 Mar 2020 20:30:08 +0100 |
| To: | bug-PerlSpeak [...] rt.cpan.org |
| From: | Juerd Waalboer <juerd [...] tnx.nl> |
TL;DR: do not use the PerlSpeak module.
The main method 'say', and several other methods, are ridden with
system() calls that contain arbitrary strings, that are likely to be
unsafe for use in a shell command. The use of 2-argument open() with
arbitrary strings is equally unsafe.
Unsafe input could come from any code that uses this module, or from the
filesystem ('fileselect' method),
I'm not providing patches, because the security issue is pervasive
throughout the module and major rewriting will be required in any case.
--
Met vriendelijke groet, // Kind regards, // Korajn salutojn,
Juerd Waalboer <juerd@tnx.nl>
TNX