|
 |
34b80e |
From cd8fcbbf402e1d70c9f325f8b0fcd99e02cf14be Mon Sep 17 00:00:00 2001
|
|
|
34b80e |
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
34b80e |
Date: Mon, 18 Nov 2013 12:52:09 +0100
|
|
|
34b80e |
Subject: [PATCH] Security notice for Proxy
|
|
|
34b80e |
MIME-Version: 1.0
|
|
|
34b80e |
Content-Type: text/plain; charset=UTF-8
|
|
|
34b80e |
Content-Transfer-Encoding: 8bit
|
|
|
34b80e |
|
|
|
34b80e |
PlRPC is not secure due to Storable. Warn Proxy users about it.
|
|
|
34b80e |
|
|
|
34b80e |
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
34b80e |
---
|
|
|
34b80e |
lib/DBD/Proxy.pm | 7 +++++++
|
|
|
34b80e |
lib/DBI/ProxyServer.pm | 7 +++++++
|
|
|
34b80e |
2 files changed, 14 insertions(+)
|
|
|
34b80e |
|
|
|
34b80e |
diff --git a/lib/DBD/Proxy.pm b/lib/DBD/Proxy.pm
|
|
|
34b80e |
index 287b2dc..5948255 100644
|
|
|
34b80e |
--- a/lib/DBD/Proxy.pm
|
|
|
34b80e |
+++ b/lib/DBD/Proxy.pm
|
|
|
34b80e |
@@ -974,6 +974,13 @@ The workaround is storing the modified local copy back to the server:
|
|
|
34b80e |
$dbh->{"csv_tables"} = $tables;
|
|
|
34b80e |
|
|
|
34b80e |
|
|
|
34b80e |
+=head1 SECURITY WARNING
|
|
|
34b80e |
+
|
|
|
34b80e |
+L<RPC::PlClient> used underneath is not secure due to serializing and
|
|
|
34b80e |
+deserializing data with L<Storable> module. Use the proxy driver only in
|
|
|
34b80e |
+trusted environment.
|
|
|
34b80e |
+
|
|
|
34b80e |
+
|
|
|
34b80e |
=head1 AUTHOR AND COPYRIGHT
|
|
|
34b80e |
|
|
|
34b80e |
This module is Copyright (c) 1997, 1998
|
|
|
34b80e |
diff --git a/lib/DBI/ProxyServer.pm b/lib/DBI/ProxyServer.pm
|
|
|
34b80e |
index 68ad4af..78a0d78 100644
|
|
|
34b80e |
--- a/lib/DBI/ProxyServer.pm
|
|
|
34b80e |
+++ b/lib/DBI/ProxyServer.pm
|
|
|
34b80e |
@@ -867,6 +867,13 @@ Don't try to put parameters into the sql-query like this:
|
|
|
34b80e |
=back
|
|
|
34b80e |
|
|
|
34b80e |
|
|
|
34b80e |
+=head1 SECURITY WARNING
|
|
|
34b80e |
+
|
|
|
34b80e |
+L<RPC::PlServer> used underneath is not secure due to serializing and
|
|
|
34b80e |
+deserializing data with L<Storable> module. Use the proxy driver only in
|
|
|
34b80e |
+trusted environment.
|
|
|
34b80e |
+
|
|
|
34b80e |
+
|
|
|
34b80e |
=head1 AUTHOR
|
|
|
34b80e |
|
|
|
34b80e |
Copyright (c) 1997 Jochen Wiedmann
|
|
|
34b80e |
--
|
|
|
34b80e |
1.8.3.1
|
|
|
34b80e |
|