Red Hat Bugzilla – Bug 1241818
Please update to >= 1.64 to let bugzilla 5.0 run.
Last modified: 2018-04-10 04:38:52 EDT
Description of problem: The new bugzilla generation 5 need version 1.64 of it, but only 1.63 is available. Version-Release number of selected component (if applicable): perl-DateTime-TimeZone-1.63-2.el7.noarch See https://www.bugzilla.org/releases/5.0/release-notes.html#v50_feat for more.
Please contact Red Hat support to properly evaluate your feature request.
The 1.64 source archive was moved to Backpan <http://backpan.perl.org/authors/id/D/DR/DROLSKY/DateTime-TimeZone-1.64.tar.gz>. Changes between 1.63 and 1.64: * Version bump. * lib/DateTime/TimeZone/Local/Unix.pm and lib/DateTime/TimeZone/OlsonDB.pm use more secure 3-argument open() instead of the 2-argument variant. * Year updated in copyright declarations. * lib/DateTime/TimeZone.pm checks class name which implements requested time zone more strictly and thus untains tainted time zone name properly. This is the only bug fix quoted in the changelog. It's one-line change. * New build-time dependencies for running tests: Test::Fatal, Test::Requires, Test::Taint. If Test::Taint and Test::Fatal are optional. * New t/22taint-mode.t test. * Upstream changelog is: +1.64 2014-02-07 + +- Under taint mode, DateTime::TimeZone->new( name => 'local' ) could die + depending on the method used to find the local time zone name. The resulting + variable would often be tainted. We now untaint all names before attempting + to load them. Reported by Stevie-O. RT #92631. + The 1.64 can be built in RHEL-7.2. All tests pass. Reproducer for the only significant change is: $ perl -T -e 'use DateTime::TimeZone; DateTime::TimeZone->new(name => $ARGV[0])' 'America/Chicago' Insecure dependency in eval while running with -T switch at /usr/share/perl5/vendor_perl/DateTime/TimeZone.pm line 79. The significant change is: --- DateTime-TimeZone-1.63/lib/DateTime/TimeZone.pm 2013-10-28 15:50:52.000000000 +0100 +++ DateTime-TimeZone-1.64/lib/DateTime/TimeZone.pm 2014-02-07 22:58:21.000000000 +0100 @@ -73,6 +67,8 @@ unless $real_class =~ /^\w+(::\w+)*$/; unless ( $real_class->can('instance') ) { + ($real_class) = $real_class =~ m{\A([a-zA-Z0-9_]+(?:::[a-zA-Z0-9_]+)*)\z}; + my $e = do { local $@; local $SIG{__DIE__}; @@ -564,7 +560,7 @@ We can either rebase the package to 1.64 or back-port the fix. Back-porting of course does not change the version number from 1.63 to 1.64.
The external bug is fixed.
The rebase is safe.
Created attachment 1296138 [details] Source repository patch rebasing to 1.64
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0664