Re: CVE-2013-2145: perl Module::Signature code execution vulnerability

[Vincent Danen <vdanen () redhat com>]

* [2013-06-05 14:51:37 -0400] Daniel Kahn Gillmor wrote:

> On 06/05/2013 02:24 PM, Russ Allbery wrote:
>
> > Speaking as a CPAN author, the second would be awesome.  For bonus points,
> > once one registers a key with CPAN, CPAN could then even check one's
> > uploads and disallow uploads that aren't signed with the proper key.
>
> As another CPAN contributor (though much less prolific than Russ), i
> also think this would be great.
>
> And wearing my hat as a member of the debian perl module packaging team,
> i would be very happy to see this level of author-specific cryptographic
> integrity checks when were updating packages from CPAN.  I suspect we
> have enough people interested in this within the debian pkg-perl to
> build in automated checks against these certifications during debian
> packaging as well.
>
> Thanks for continuing to maintain such a great archive of useful, free code.

I guess the big question then is what is the way forward?  I'm not that
familiar with CPAN other than occasionally using it, but is there some
kind of governing body that this can be brought up to?  I imagine
someone is going to have to host this and start the wheels moving, but
I honestly have no idea who that might be.

I think it would be ideal to do something like this (in fact, I wish
that all of the module repositories for various programming languages
would do the same).  It might be a great opportunity to show some
leadership in this area so that other languages may adopt something
similar.


--
Vincent Danen / Red Hat Security Response Team