Bug 16975 - DSA-3628-1 perl -- security update
Summary: DSA-3628-1 perl -- security update
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal (vote)
Assignee: Galen Charlton
QA Contact: Testopia
Depends on:
Reported: 2016-07-25 20:46 UTC by Chris Cormack
Modified: 2017-06-14 22:10 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:

Bug 16975 : @INC should not have '.' as its last entry (982 bytes, patch)
2016-07-25 21:05 UTC, Chris Cormack
Details | Diff | Splinter Review
Bug 16975 : @INC should not have '.' as its last entry (1.03 KB, patch)
2016-08-01 10:07 UTC, Jonathan Druart
Details | Diff | Splinter Review
[PASSED QA] Bug 16975 : @INC should not have '.' as its last entry (1.10 KB, patch)
2016-08-03 21:47 UTC, Katrin Fischer
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Chris Cormack 2016-07-25 20:46:58 UTC

The part that effects Koha is the @INC bit

The problem relates to Perl 5 ("perl") loading modules from the includes
directory array ("@INC") in which the last element is the current
directory ("."). For more information, see the RT ticket linked above.

While the Perl Security group has attempted to mitigate some of these
problems by modifying Perl Modules, it is ultimately the responsibility
of the application writer to remove relative paths from @INC to assure
the security / consistent behavior of their code regardless of what
directory it executes from.

The fix is to check if the last entry of @INC is "." and if so, to
remove it as an included path.

The following line, when added to the top of Perl applications, should
mitigate this problem. This assumes your code is not intentionally
depending on paths relative to your current working directory:

    BEGIN { pop @INC if $INC[-1] eq '.' }

We would also like to discourage using relative paths in @INC.

I only found 2 places where we set the @INC specifically inside Koha 

Koha/Plugins.pm:    push @INC, C4::Context->config("pluginsdir");
Koha/Plugins/Handler.pm:    push @INC, C4::Context->config("pluginsdir");

Potentially if someone put . as the plugins dir in the config they would leave themselves open to this. While it is unlikely anyone would do this, we may as well add a fix to protect if they did.
Comment 1 Chris Cormack 2016-07-25 21:05:20 UTC Comment hidden (obsolete)
Comment 2 Jonathan Druart 2016-08-01 10:07:38 UTC Comment hidden (obsolete)
Comment 3 Katrin Fischer 2016-08-03 21:46:58 UTC
Tested with the kitchen sink plugin.
Comment 4 Katrin Fischer 2016-08-03 21:47:34 UTC
Created attachment 53979 [details] [review]
[PASSED QA] Bug 16975 : @INC should not have '.' as its last entry

To Test
1/ Try using a plugin
2/ Apply patch
3/ Test plugin still works

Signed-off-by: Jonathan Druart <jonathan.druart@bugs.koha-community.org>

Signed-off-by: Katrin Fischer <katrin.fischer.83@web.de>
Comment 5 Brendan Gallagher 2016-08-04 19:39:45 UTC
Pushed to Master - Should be in the November 2016 release.  Thanks!
Comment 6 Frédéric Demians 2016-08-05 06:22:23 UTC
Pushed in 16.05. Will be in 16.05.03.
Comment 7 Chris Cormack 2016-08-08 07:09:52 UTC
Pushed to 3.20.x will be in 3.20.14
Comment 8 Julian Maurice 2016-08-17 12:57:32 UTC
Patch pushed to 3.22.x, will be in 3.22.10