Package: perl-modules Version: 5.10.0-19lenny3 Severity: normal
Packages using SelfLoader (older ones, generally) seem to have broken recently when taint checking is enabled. I haven't narrowed down exactly where this was introduced, but I don't believe I saw it prior to the 5.0.8 point release of Lenny, which included perl security fixes. Quickie repro case, using News::Article (in debian as libnews-article-perl), where I first noticed this: $ perl -w -MNews::Article -T -e '$x = new News::Article("")' Insecure dependency in eval while running with -T switch at /usr/share/perl/5.10/SelfLoader.pm line 59 Slightly longer repro case without depending on libnews-article-perl: $ cat > Foo.pm <<FOO_PM package Foo; use SelfLoader; 1; __DATA__ sub foo { print "foo called\n"; } FOO_PM $ perl -I. -MFoo -T -e 'Foo->foo()' Insecure dependency in eval while running with -T switch at /usr/share/perl/5.10/SelfLoader.pm line 59 I've also reproduced this with 5.10.1-17 on Sid. -- System Information: Debian Release: 5.0.8 APT prefers oldstable APT policy: (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 2.6.26-2-amd64 (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages perl-modules depends on: ii perl 5.10.0-19lenny3 Larry Wall's Practical Extraction perl-modules recommends no packages. perl-modules suggests no packages. -- debconf-show failed -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org