Skip to content

Commit e05b7c7

Browse files
bschmalhoferbschmalhofer
committed
Issue #2923: Update CPAN::Audit to 20240117.001
1 parent 6bd15b6 commit e05b7c7

File tree

6 files changed

+107
-24
lines changed

6 files changed

+107
-24
lines changed

‎Kernel/System/Environment.pm

+1-1
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,7 @@ sub BundleModulesDeclarationGet {
311311
{
312312
'Module' => 'CPAN::Audit',
313313
'Required' => 1,
314-
'VersionRequired' => '== 20240103.002',
314+
'VersionRequired' => '== 20240117.001',
315315
},
316316
{
317317
'Comment' => 'needed by CPAN::Audit',

‎Kernel/cpan-lib/CPAN/Audit.pm

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ use CPAN::Audit::Version;
1414
use CPAN::Audit::Query;
1515
use CPAN::Audit::DB;
1616

17-
our $VERSION = '20240103.002';
17+
our $VERSION = '20240117.001';
1818

1919
sub new {
2020
my( $class, %params ) = @_;

‎Kernel/cpan-lib/CPAN/Audit/DB.pm

+90-8
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
# created by util/generate at Wed Jan 3 21:54:50 2024
2-
# cpan-security-advisory bdc3863dd33276fe8343e89da2006905c0cdc130
1+
# created by util/generate at Wed Jan 17 12:58:13 2024
2+
# cpan-security-advisory ddb1f55cc6e68fac82c8f55852c8459ecb859416
33
#
44
package CPAN::Audit::DB;
55

66
use strict;
77
use warnings;
88

9-
our $VERSION = '20240103.004';
9+
our $VERSION = '20240117.001';
1010

1111
sub db {
1212
{
@@ -4690,6 +4690,10 @@ sub db {
46904690
{
46914691
'date' => '2023-11-01T07:57:12',
46924692
'version' => '4.60'
4693+
},
4694+
{
4695+
'date' => '2024-01-08T15:17:04',
4696+
'version' => '4.61'
46934697
}
46944698
]
46954699
},
@@ -22889,6 +22893,10 @@ sub db {
2288922893
{
2289022894
'date' => '2019-05-24T18:54:07',
2289122895
'version' => '2.04'
22896+
},
22897+
{
22898+
'date' => '2024-01-08T04:48:56',
22899+
'version' => '2.05'
2289222900
}
2289322901
]
2289422902
},
@@ -38650,6 +38658,10 @@ sub db {
3865038658
{
3865138659
'date' => '2024-01-02T15:38:07',
3865238660
'version' => '5.503'
38661+
},
38662+
{
38663+
'date' => '2024-01-08T18:22:18',
38664+
'version' => '5.503'
3865338665
}
3865438666
]
3865538667
},
@@ -46429,6 +46441,22 @@ sub db {
4642946441
{
4643046442
'date' => '2023-12-24T15:48:59',
4643146443
'version' => '1.42'
46444+
},
46445+
{
46446+
'date' => '2024-01-04T11:21:08',
46447+
'version' => '1.42_01'
46448+
},
46449+
{
46450+
'date' => '2024-01-08T09:38:46',
46451+
'version' => '1.42_02'
46452+
},
46453+
{
46454+
'date' => '2024-01-10T15:04:01',
46455+
'version' => '1.42_03'
46456+
},
46457+
{
46458+
'date' => '2024-01-17T09:07:40',
46459+
'version' => '1.42_04'
4643246460
}
4643346461
]
4643446462
},
@@ -47509,6 +47537,18 @@ sub db {
4750947537
{
4751047538
'date' => '2024-01-02T14:34:40',
4751147539
'version' => '1.93_03'
47540+
},
47541+
{
47542+
'date' => '2024-01-05T00:45:35',
47543+
'version' => '1.93_04'
47544+
},
47545+
{
47546+
'date' => '2024-01-06T18:39:23',
47547+
'version' => '1.93_05'
47548+
},
47549+
{
47550+
'date' => '2024-01-08T01:22:27',
47551+
'version' => '1.94'
4751247552
}
4751347553
]
4751447554
},
@@ -50756,6 +50796,14 @@ sub db {
5075650796
{
5075750797
'date' => '2015-11-21T06:05:48',
5075850798
'version' => '1.013_03'
50799+
},
50800+
{
50801+
'date' => '2024-01-04T15:11:21',
50802+
'version' => '1.015'
50803+
},
50804+
{
50805+
'date' => '2024-01-05T13:57:01',
50806+
'version' => '1.016'
5075950807
}
5076050808
]
5076150809
},
@@ -52296,6 +52344,10 @@ sub db {
5229652344
{
5229752345
'date' => '2022-09-05T15:48:11',
5229852346
'version' => '1.0050'
52347+
},
52348+
{
52349+
'date' => '2024-01-05T23:11:02',
52350+
'version' => '1.0051'
5229952351
}
5230052352
]
5230152353
},
@@ -55534,17 +55586,39 @@ sub db {
5553455586
'advisories' => [
5553555587
{
5553655588
'affected_versions' => '<0.28',
55537-
'cves' => [],
55538-
'description' => 'ParseXLSX also handles with merged cells, but the memoize implementation allows attacker to allocate an arbitrary memory size.
55589+
'cves' => [
55590+
'CVE-2024-22368'
55591+
],
55592+
'description' => 'The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.
5553955593
',
5554055594
'distribution' => 'Spreadsheet-ParseXLSX',
5554155595
'fixed_versions' => '>=0.28',
55542-
'id' => 'CPANSA-Spreadsheet-ParseXLSX-2024-01',
55596+
'id' => 'CPANSA-Spreadsheet-ParseXLSX-2024-22368',
5554355597
'references' => [
5554455598
'https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md',
55545-
'https://github.com/briandfoy/cpan-security-advisory/issues/131'
55599+
'https://github.com/briandfoy/cpan-security-advisory/issues/131',
55600+
'https://nvd.nist.gov/vuln/detail/CVE-2024-22368',
55601+
'https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md',
55602+
'https://metacpan.org/dist/Spreadsheet-ParseXLSX/changes',
55603+
'https://github.com/advisories/GHSA-x2hg-844v-frvh'
5554655604
],
5554755605
'reported' => '2024-01-03'
55606+
},
55607+
{
55608+
'affected_versions' => '<0.30',
55609+
'cves' => [],
55610+
'description' => 'In default configuration of Spreadsheet::ParseXLSX, whenever we call Spreadsheet::ParseXLSX->new()->parse(\'user_input_file.xlsx\'), we\'d be vulnerable for XXE vulnerability if the XLSX file that we are parsing is from user input.
55611+
',
55612+
'distribution' => 'Spreadsheet-ParseXLSX',
55613+
'fixed_versions' => '>=0.30',
55614+
'id' => 'CPANSA-Spreadsheet-ParseXLSX-2024-02',
55615+
'references' => [
55616+
'https://metacpan.org/release/NUDDLEGG/Spreadsheet-ParseXLSX-0.30/changes',
55617+
'https://gist.github.com/phvietan/d1c95a88ab6e17047b0248d6bf9eac4a',
55618+
'https://github.com/briandfoy/cpan-security-advisory/issues/134',
55619+
'https://github.com/MichaelDaum/spreadsheet-parsexlsx/issues/10'
55620+
],
55621+
'reported' => '2024-01-17'
5554855622
}
5554955623
],
5555055624
'main_module' => 'Spreadsheet::ParseXLSX',
@@ -55664,6 +55738,10 @@ sub db {
5566455738
{
5566555739
'date' => '2024-01-02T17:49:11',
5566655740
'version' => '0.29'
55741+
},
55742+
{
55743+
'date' => '2024-01-17T11:34:43',
55744+
'version' => '0.30'
5566755745
}
5566855746
]
5566955747
},
@@ -61657,6 +61735,10 @@ sub db {
6165761735
{
6165861736
'date' => '2023-07-17T22:02:15',
6165961737
'version' => '6.72'
61738+
},
61739+
{
61740+
'date' => '2024-01-13T20:26:02',
61741+
'version' => '6.73'
6166061742
}
6166161743
]
6166261744
},
@@ -63404,7 +63486,7 @@ sub db {
6340463486
'severity' => undef
6340563487
},
6340663488
{
63407-
'affected_versions' => '>=5.30.0,<5.38.2',
63489+
'affected_versions' => '>=5.30.0,<5.36.3,>=5.38.0,<5.38.2',
6340863490
'cves' => [
6340963491
'CVE-2023-47100'
6341063492
],

‎Kernel/cpan-lib/CPAN/Audit/DB.pm.gpg

+13-13
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
-----BEGIN PGP SIGNATURE-----
22

3-
iQIzBAABCAAdFiEEdaq0LLoNfzfw1oht+D+NXoeLYEEFAmWWHfoACgkQ+D+NXoeL
4-
YEEJmQ//Y2Bxkajm4LDUFVkDmWNgbHfQ7F0rXHLnrHMXrOCZwMRD759bRadZcGZ0
5-
pgUoL9K634MGoID0KCwD1gP7m2WPWziodXPTLEQILEb/7DyNq6lgWU3dRMW3j7r1
6-
VDK/TTpHw6FXTLOgEM7MXwRDXbCm9gI67DrIem12fUuptAMJSrzEI1NUbmfKZtgY
7-
S8zwXZijHx3qlrLX64atqwpdkb8ZASqnb8pBWzmCFMGXH3H5/pvgQNgyYtksi2qV
8-
+FKAJ3gKyU+rgvn91lBNLaqzXtvVRUl0q7xDHhMZu8qjQWTlRUzqwk65alCKlELx
9-
hGv6iFCx93oT6GEDPCLhAgJvf6VBs+CxcY8LvQeruw7NSEosVU4B4SZp3QPeyGlY
10-
Lo7wkycEKVyrz6ILMCdMYbNNsKfUHwgVOrFSG1fn6yJnocbrb1Rn+h6veJLkiuW+
11-
lJalNMQwtLzlU6besUnxzk2HBFy8yRO7sVtZs99YkJkLQyfZOb+RjZaqZPlJuWkS
12-
a6OaCQDNbyA/Lk4/O51/bFSEXR+L6ZLHAhQHkPVSJg5jjWbxsX5oF2cTZSAlGBAe
13-
qczAVeOtCmHWKl7LH8IDFznL6r7ufOKXym2GBpx0v0aUxCGUKOclADxyoPWFX/Or
14-
u1+UppxsFCF46Xlv98SEp9aVsG4aJJQZUThj0AotigZeBaBqvpc=
15-
=+bH0
3+
iQIzBAABCAAdFiEEdaq0LLoNfzfw1oht+D+NXoeLYEEFAmWoFTUACgkQ+D+NXoeL
4+
YEFeJw//YNSKVBZ8ibx286HRuZZUmXTIlcVmM1GzjaL5eJ5B+3JJgON7UInNnbDQ
5+
Tlv1/AfdgGKGR5JfLYkgriE+ixfKtMTnpGSz4opV6hMF2CXm2+U2+Rqk/TC/4mUK
6+
y/HSWaCQAzGHQt+BRRUFT8SpaCBVLpwoMeG5kvDV/J0CdTwyUmh5gUVZ+fQIKKk6
7+
8TduyqPwbDPf2Dexz/cq97UfEDvhecnFC73Umo46KlEFshfImQ9t2Rp63PWvVZ3Q
8+
oD4AGDvqQUCUnT+Fank/g4/+lFmDyaBVXkLt6VEh5aXMWQvl98Be2tD/5Fxjyym0
9+
WsEYbtNzE5pcgJ6cyeVEzGzoqqwETHPDosuXOJMjcKjrIBRCWDMpVNtXefmJY9ah
10+
Ip4oYJE3DPkkFdC42FqdsPUtWM7QFhzASHG78Lmd1hAstaUEeHEbOCVlxQhOANeb
11+
Ps2/lW1AkZkfw0RGlPc1zRSkKNCrEW50R8eg59oLoUbKmJBDsvv24aSj5X/S8U6K
12+
4nLU+XsJvhkoMORVfTWKl8COUb8kGHZae2hL+ufet0qnKDNaD2KwMmp4sFT3Y0cp
13+
WtnPiqpN+xOJzdZwhvZjLcyM93YfLk9FOAw9AmMiIfE/MT+HnE9wXxHTcKHFHpOE
14+
dAYN/gmDM7mdvp9TmJGdx8cgO5IwrYVVgftprIy+OPK15xZT9Zc=
15+
=mlRh
1616
-----END PGP SIGNATURE-----

‎Kernel/cpan-lib/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ Only install modules where the version was updated in F<cpanfile>.
2828
rm -rf local
2929
PERL5LIB=. cpanm --notest --installdeps . --local-lib local # install into local/lib/perl5
3030
PERL5LIB=. cpanm --notest --installdeps . --local-lib local # again, to see that the install was complete
31+
cp -r local/lib/perl5/* . # copy to actual destination
3132

3233
### Remove files and directories that should not be bundled with OTOBO
3334

‎Kernel/cpan-lib/cpanfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ requires 'Class::Inspector', '== 1.31';
1919
# needed by Data::ICal
2020
requires 'Class::ReturnValue', '== 0.55';
2121

22-
requires 'CPAN::Audit', '== 20240103.002';
22+
requires 'CPAN::Audit', '== 20240117.001';
2323

2424
# needed by CPAN::Audit
2525
requires 'CPAN::DistnameInfo', '== 0.12';

0 commit comments

Comments
 (0)