CVE-2013-2145: Improper Input Validation (CWE-20)
value: The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-08-19T23:55Z
Repository: https://github.com/audreyt/module-signature
Language: Other
Files changed: Changes, META.yml, lib/Module/Signature.pm
Commit date: 2013-06-04 18:28:43 +0800
Commit message: * Version 71 with advisory from @fweimer

Diff: diff --git a/Changes b/Changes
index c1ba8bd..d5e684d 100644
--- a/Changes
+++ b/Changes
@@ -1,5 +1,13 @@
+[Changes for 0.71 - Tue Jun  4 18:24:10 CST 2013]
+
+* Constrain the user-specified digest name to /^\w+\d+$/.
+
+* Avoid loading Digest::* from relative paths in @INC.
+
+  Contributed by: Florian Weimer
+
 [Changes for 0.70 - Thu Nov 29 01:45:54 CST 2012]
 
 * Don't check gpg version if gpg does not exist.
 
   This avoids unnecessary warnings during installation
diff --git a/META.yml b/META.yml
index 5ecd3dd..4344774 100644
--- a/META.yml
+++ b/META.yml
@@ -23,6 +23,6 @@ no_index:
 requires:
   IO::Socket::INET: 0
   perl: 5.005
 resources:
   repository: http://github.com/audreyt/module-signature
-version: 0.70
+version: 0.71
diff --git a/lib/Module/Signature.pm b/lib/Module/Signature.pm
index 0140f32..9d4b095 100644
--- a/lib/Module/Signature.pm
+++ b/lib/Module/Signature.pm
@@ -1,7 +1,7 @@
 package Module::Signature;
-$Module::Signature::VERSION = '0.70';
+$Module::Signature::VERSION = '0.71';
 
 use 5.005;
 use strict;
 use vars qw($VERSION $SIGNATURE @ISA @EXPORT_OK);
 use vars qw($Preamble $Cipher $Debug $Verbose $Timeout);
@@ -530,22 +530,27 @@ sub _mkdigest {
     return $plaintext;
 }
 
 sub _digest_object {
     my($algorithm) = @_;
+
+    # Avoid loading Digest::* from relative paths in @INC.
+    local @INC = grep { /^[^.]/ } @INC;
+
+    # Constrain algorithm name to be of form ABC123.
+    my ($base, $variant) = ($algorithm =~ /^([_a-zA-Z]+)([0-9]+)$/g)
+        or die "Malformed algorithm name: $algorithm (should match /\\w+\\d+/)";
+
     my $obj = eval { Digest->new($algorithm) } || eval {
-        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
         require "Digest/$base.pm"; "Digest::$base"->new($variant)
     } || eval {
         require "Digest/$algorithm.pm"; "Digest::$algorithm"->new
     } || eval {
-        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
         require "Digest/$base/PurePerl.pm"; "Digest::$base\::PurePerl"->new($variant)
     } || eval {
         require "Digest/$algorithm/PurePerl.pm"; "Digest::$algorithm\::PurePerl"->new
     } or do { eval {
-        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
         warn "Unknown cipher: $algorithm, please install Digest::$base, Digest::$base$variant, or Digest::$base\::PurePerl\n";
     } and return } or do {
         warn "Unknown cipher: $algorithm, please install Digest::$algorithm\n"; return;
     };
     $obj;

Vulnerable code: version: 0.70
$Module::Signature::VERSION = '0.70';
        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
        my ($base, $variant) = ($algorithm =~ /^(\w+?)(\d+)$/g) or die;
Fixed code: [Changes for 0.71 - Tue Jun  4 18:24:10 CST 2013]

* Constrain the user-specified digest name to /^\w+\d+$/.

* Avoid loading Digest::* from relative paths in @INC.

  Contributed by: Florian Weimer

version: 0.71
$Module::Signature::VERSION = '0.71';

    # Avoid loading Digest::* from relative paths in @INC.
    local @INC = grep { /^[^.]/ } @INC;

    # Constrain algorithm name to be of form ABC123.
    my ($base, $variant) = ($algorithm =~ /^([_a-zA-Z]+)([0-9]+)$/g)
        or die "Malformed algorithm name: $algorithm (should match /\\w+\\d+/)";