Bug#954238: libperlspeak-perl: CVE-2020-10674

[Salvatore Bonaccorso]

Source: libperlspeak-perl
Version: 2.01-2
Severity: grave
Tags: security upstream
Justification: user security hole
Forwarded: https://rt.cpan.org/Public/Bug/Display.html?id=132173
Control: tags -1 + stretch buster bullseye sid

Hi,

The following vulnerability was published for libperlspeak-perl.

CVE-2020-10674[0]:
| PerlSpeak through 2.01 allows attackers to execute arbitrary OS
| commands, as demonstrated by use of system and 2-argument open.

Gregor, the module seem to be basically unmaintained, I would propose
to actually remove the package from unstable and likely given there
are no reverse dependencies as well from any other suite.  What do you
think?

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-10674
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10674
[1] https://rt.cpan.org/Public/Bug/Display.html?id=132173

Regards,
Salvatore