CVE-2013-2145: Improper Input Validation (CWE-20)
value: The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
CWE description: The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Published: 2013-08-19T23:55Z
Repository: https://github.com/audreyt/module-signature
Language: Other
Files changed: Changes, META.yml, README, lib/Module/Signature.pm
Commit date: 2013-06-05 23:21:02 +0800
Commit message: * 0.72 with an improved path checker from @fweimer

Diff: diff --git a/Changes b/Changes
index d5e684d..a83c95e 100644
--- a/Changes
+++ b/Changes
@@ -1,5 +1,12 @@
+[Changes for 0.72 - Wed Jun  5 23:19:02 CST 2013]
+
+* Only allow loading Digest::* from absolute paths in @INC,
+  by ensuring they begin with \ or / characters.
+
+  Contributed by: Florian Weimer
+
 [Changes for 0.71 - Tue Jun  4 18:24:10 CST 2013]
 
 * Constrain the user-specified digest name to /^\w+\d+$/.
 
 * Avoid loading Digest::* from relative paths in @INC.
diff --git a/META.yml b/META.yml
index 4344774..c773370 100644
--- a/META.yml
+++ b/META.yml
@@ -23,6 +23,6 @@ no_index:
 requires:
   IO::Socket::INET: 0
   perl: 5.005
 resources:
   repository: http://github.com/audreyt/module-signature
-version: 0.71
+version: 0.72
diff --git a/README b/README
index cab1e8f..1468877 100644
--- a/README
+++ b/README
@@ -243,10 +243,12 @@ SEE ALSO
 
     ExtUtils::Manifest, Crypt::OpenPGP, Test::Signature
 
     Module::Install, ExtUtils::MakeMaker, Module::Build
 
+    Dist::Zilla::Plugin::Signature
+
 AUTHORS
     唐鳳 <cpan@audreyt.org>
 
 CC0 1.0 Universal
     To the extent possible under law, 唐鳳 has waived all copyright and
diff --git a/lib/Module/Signature.pm b/lib/Module/Signature.pm
index ddbba51..82374fe 100644
--- a/lib/Module/Signature.pm
+++ b/lib/Module/Signature.pm
@@ -1,7 +1,7 @@
 package Module::Signature;
-$Module::Signature::VERSION = '0.71';
+$Module::Signature::VERSION = '0.72';
 
 use 5.005;
 use strict;
 use vars qw($VERSION $SIGNATURE @ISA @EXPORT_OK);
 use vars qw($Preamble $Cipher $Debug $Verbose $Timeout);
@@ -532,11 +532,11 @@ sub _mkdigest {
 
 sub _digest_object {
     my($algorithm) = @_;
 
     # Avoid loading Digest::* from relative paths in @INC.
-    local @INC = grep { /^[^.]/ } @INC;
+    local @INC = grep { m{^[\\/]} } @INC;
 
     # Constrain algorithm name to be of form ABC123.
     my ($base, $variant) = ($algorithm =~ /^([_a-zA-Z]+)([0-9]+)$/g)
         or die "Malformed algorithm name: $algorithm (should match /\\w+\\d+/)";
 

Vulnerable code: version: 0.71
$Module::Signature::VERSION = '0.71';
    local @INC = grep { /^[^.]/ } @INC;
Fixed code: [Changes for 0.72 - Wed Jun  5 23:19:02 CST 2013]

* Only allow loading Digest::* from absolute paths in @INC,
  by ensuring they begin with \ or / characters.

  Contributed by: Florian Weimer

version: 0.72
    Dist::Zilla::Plugin::Signature

$Module::Signature::VERSION = '0.72';
    local @INC = grep { m{^[\\/]} } @INC;