perl: add upstream security fix for CVE-2018-12015
authorPeter Korsgaard <peter@korsgaard.com>
Tue, 12 Jun 2018 15:21:30 +0000 (17:21 +0200)
committerThomas Petazzoni <thomas.petazzoni@bootlin.com>
Wed, 13 Jun 2018 20:52:11 +0000 (22:52 +0200)
commit66760f27342fccacdba64269525a3a32d0518905
tree2ba428f3a68da5e912e9d6b54b7bd4312834fd6d
parentcbf4ead19c7336efd5e04becea23727ca65ffdaf
perl: add upstream security fix for CVE-2018-12015

Fixes CVE-2018-12015 - In Perl through 5.26.2, the Archive::Tar module
allows remote attackers to bypass a directory-traversal protection
mechanism, and overwrite arbitrary files, via an archive file containing a
symlink and a regular file with the same name.

Patch from
https://github.com/jib/archive-tar-new/commit/ae65651eab053fc6dc4590dbb863a268215c1fc5
with path rewritten to match perl tarball.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
package/perl/0001-PATCH-Remove-existing-files-before-overwriting-them.patch [new file with mode: 0644]