Is there a list of CERT advisories keyed to fixed Perl versions?
Is there a list of CERT advisories for Perl and the corresponding version in which p5p fixed them? I know that they have responded to almost all of the serious advisories with the patched versions for even the "unmaintained" versions.
I was wondering about that last week as I was reviewing a code base that runs on v5.8, a common situation for companies with big Perl applications that have been around for awhile. I'd like to have some chart that shows which vulnerabilities you have based on your Perl version.
I figure someone might have this somewhere, so I haven't done the work to make the list myself.
Curiously, I found that CERT has Perl programming standards. Now I'd like a Perl::Critic plugin that checks all the CERT things. I think that would be a good candidate for a TPF grant, actually.
Who's invented the day extender so I can get twice the time each day to do all the things I want? :)
I'm the author of Mastering Perl, and the co-author of Learning Perl (6th Edition), Intermediate Perl, Programming Perl (4th Edition) and Effective Perl Programming (2nd Edition).
Hi brian! You can search the CVE/NVD for a lot of products, including perl, separated by version.
The link below, for example, should contain the list of known vulnerabilities ever found in perl:
http://web.nvd.nist.gov/view/vuln/search-results?adv_search=true&cves=on&cve_id=&query=&cwe_id=&cpe_product=cpe%3A%2Fa%3Aperl%3Aperl&cpe_version=&pub_date_start_month=-1&pub_date_start_year=-1&pub_date_end_month=-1&pub_date_end_year=-1&mod_date_start_month=-1&mod_date_start_year=-1&mod_date_end_month=-1&mod_date_end_year=-1&cvss_sev_base=&cvss_av=&cvss_ac=&cvss_au=&cvss_c=&cvss_i=&cvss_a=
Is that the only place where vunlerabilities are reported? 18 results seems really low, and I don't see a Syslog report in there.
Some of those CERT recommendations do list Perl::Critic modules under "Automated Detection." (This one, for example.) It would be pretty awesome to have a single policy bundle for all those recommendations, though.
I'm feeling an itch in my coding fingers...
xkcd: 28 Hour Day
It would be trivial to create a theme includes all the existing Perl::Critic policies that fall under the CERT guidelines. See
http://search.cpan.org/~thaljef/Perl-Critic-1.118/lib/Perl/Critic/DEVELOPER.pod#Themes
Patches welcome.
-Jeff
Another thing to consider would be for Perl::Critic (or cpan, etc) to trigger an alert when vulnerable CPAN modules are used.
The Java community has recently attempted to tackle this problem i.e. https://github.com/jeremylong/DependencyCheck#readme and http://www.scmagazine.com.au/News/320617,redhat-project-fights-java-vulnerabilities.aspx