Date: Fri, 15 Mar 2013 09:54:55 -0400 From: Ryan Steinmetz <zi@FreeBSD.org> To: freebsd@tern.ru Cc: freebsd-security@freebsd.org Subject: Re: old perl vulnerabilitiy Message-ID: <20130315135454.GA41210@exodus.zi0r.com> In-Reply-To: <1472823038.20130315173020@tern.ru> References: <1472823038.20130315173020@tern.ru>
next in thread | previous in thread | raw e-mail | index | archive | help
On (03/15/13 17:30), freebsd@tern.ru wrote: >Hello Freebsd-security, > >I've got portaudit alarm on perl-5.8.9_7 with regard to > >perl -- denial of service via algorithmic complexity attack on hashing routines. >Reference: http://portaudit.FreeBSD.org/68c1f75b-8824-11e2-9996-c48508086173.html > >But on the other server I have perl-threaded-5.8.9_7 >and portaudit thinks that it is OK (no problem) > >Is it correct? >It seems to me that threaded perl also should have the same problem. > It does have the same issue. I've corrected the VuXML entry and you should see updated portaudit results within 30 minutes. Your 5.8.9 perl-threaded installation should also show up as vulnerable to the same issue. Thanks! -r >Please advise. > >PS. I know that it is old and "unsupported" but I don't want to > upgrade without serious reason. And, any way, the "behavior" of > portaudit seems to me not correct. > > >With best regards, >Alexandre Krasnov. > > >_______________________________________________ >freebsd-security@freebsd.org mailing list >http://lists.freebsd.org/mailman/listinfo/freebsd-security >To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org" -- Ryan Steinmetz PGP: EF36 D45A 5CA9 28B1 A550 18CD A43C D111 7AD7 FAF2
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20130315135454.GA41210>