openbsd-pkg_add

OpenBSD pkg_add Audit Findings

Security audit of OpenBSD's pkg_add, the package installation tool, along with the supporting Perl modules under OpenBSD/ that handle repositories, ustar archive extraction, and the on-disk package database. Each finding includes a detailed write-up and a patch.

Summary

Total findings: 7 -- High: 5, Medium: 1, Low: 1

Findings

Repository handlers

#	Finding	Severity
001	Repository URL is executed through the shell	High
002	Repository EOF hangs HTTP reader	Low
006	scp repository host injects ssh options	High

Archive extraction

#	Finding	Severity
003	Archive path escapes destination tree	High
004	Symlink entry redirects later file extraction	High
007	Archive mode validation uses wrong object	High

Package database

#	Finding	Severity
005	Package database repair follows metadata symlinks	Medium