Register | Log in

libnet-oauth-perl

implementation of the OAuth 1.0 protocol

Choose email to subscribe with

general

source: libnet-oauth-perl (main)
version: 0.33-1
maintainer: Debian Perl Group (archive) (DMD) (LowNMU)
uploaders: gregor herrmann (DMD)
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.28-3
oldstable: 0.28-4
stable: 0.31-1
testing: 0.33-1
unstable: 0.33-1

versioned links

0.28-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.28-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.31-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
0.33-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libnet-oauth-perl

action needed

5 security issues in bullseye high

There are 5 open security issues in bullseye.

4 important issues:

CVE-2026-72887: Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.
CVE-2026-72888: Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.
CVE-2026-72889: Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the algorithm used to check a signature is chosen by whoever sent it, and nothing lets the verifying party pin the method instead. When a message names HMAC-SHA1 or HMAC-SHA256, the key is derived from consumer_secret and token_secret rather than from the key the provider deployed. A provider deployed on RSA-SHA1 holds only the consumer public key, and RFC 5849 does not use consumer_secret for that method, so the required parameter is filled with a placeholder. A client that names HMAC-SHA1 instead has its signature checked against that placeholder, so a guessable one is enough to forge requests for any consumer key and token.
CVE-2026-75589: Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings. A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.

1 issue postponed or untriaged:

CVE-2025-22376: (postponed; to be fixed through a stable update) In Net::OAuth::Client in the Net::OAuth package before 0.29 for Perl, the default nonce is a 32-bit integer generated from the built-in rand() function, which is not cryptographically strong.

Created: 2026-08-16 Last update: 2026-08-29 01:32

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 0.33-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 01704ca2fc8df1fd47441f40db06eae4848ce24e
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 02:49:35 2026 +0100

    update changelog
    
    Gbp-Dch: Ignore

commit fb3da82bb1bd37bd7a6e1456ea4c9a7f3ccab151
Author: gregor herrmann <gregoa@debian.org>
Date:   Sun Nov 8 02:49:35 2026 +0100

    Convert debian/watch to version 5.

Created: 2026-11-08 Last update: 2026-11-08 02:33

4 low-priority security issues in trixie low

There are 4 open security issues in trixie.

4 issues left for the package maintainer to handle:

CVE-2026-72887: (needs triaging) Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.
CVE-2026-72888: (needs triaging) Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.
CVE-2026-72889: (needs triaging) Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify. verify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the algorithm used to check a signature is chosen by whoever sent it, and nothing lets the verifying party pin the method instead. When a message names HMAC-SHA1 or HMAC-SHA256, the key is derived from consumer_secret and token_secret rather than from the key the provider deployed. A provider deployed on RSA-SHA1 holds only the consumer public key, and RFC 5849 does not use consumer_secret for that method, so the required parameter is filled with a placeholder. A client that names HMAC-SHA1 instead has its signature checked against that placeholder, so a guessable one is enough to forge requests for any consumer key and token.
CVE-2026-75589: (needs triaging) Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify. Each of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings. A client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-08-16 Last update: 2026-09-04 15:02

news

[2026-08-29] libnet-oauth-perl 0.33-1 MIGRATED to testing (Debian testing watch)
[2026-08-19] Accepted libnet-oauth-perl 0.33-1 (source) into unstable (gregor herrmann)
[2026-08-16] Accepted libnet-oauth-perl 0.32-1 (source) into unstable (gregor herrmann)
[2026-08-13] libnet-oauth-perl 0.31-2 MIGRATED to testing (Debian testing watch)
[2026-08-09] Accepted libnet-oauth-perl 0.31-2 (source) into unstable (gregor herrmann)
[2026-07-31] libnet-oauth-perl REMOVED from testing (Debian testing watch)
[2025-04-15] libnet-oauth-perl 0.31-1 MIGRATED to testing (Debian testing watch)
[2025-04-12] Accepted libnet-oauth-perl 0.31-1 (source) into unstable (gregor herrmann)
[2025-01-09] libnet-oauth-perl 0.30-1 MIGRATED to testing (Debian testing watch)
[2025-01-04] Accepted libnet-oauth-perl 0.30-1 (source) into unstable (gregor herrmann)
[2022-05-31] libnet-oauth-perl 0.28-4 MIGRATED to testing (Debian testing watch)
[2022-05-29] Accepted libnet-oauth-perl 0.28-4 (source) into unstable (Damyan Ivanov)
[2018-05-11] libnet-oauth-perl 0.28-3 MIGRATED to testing (Debian testing watch)
[2018-05-08] Accepted libnet-oauth-perl 0.28-3 (source) into unstable (gregor herrmann)
[2015-06-21] libnet-oauth-perl 0.28-2 MIGRATED to testing (Britney)
[2015-06-09] Accepted libnet-oauth-perl 0.28-2 (source all) into unstable (Damyan Ivanov)
[2012-01-21] libnet-oauth-perl 0.28-1 MIGRATED to testing (Debian testing watch)
[2012-01-10] Accepted libnet-oauth-perl 0.28-1 (source all) (Jotam Jr. Trejo) (signed by: gregor herrmann)
[2011-08-17] libnet-oauth-perl 0.27-2 MIGRATED to testing (Debian testing watch)
[2011-08-06] Accepted libnet-oauth-perl 0.27-2 (source all) (Salvatore Bonaccorso)
[2010-06-29] libnet-oauth-perl 0.27-1 MIGRATED to testing (Debian testing watch)
[2010-06-18] Accepted libnet-oauth-perl 0.27-1 (source all) (gregor herrmann)
[2010-04-14] libnet-oauth-perl 0.25-1 MIGRATED to testing (Debian testing watch)
[2010-04-03] Accepted libnet-oauth-perl 0.25-1 (source all) (gregor herrmann)
[2010-03-23] libnet-oauth-perl 0.22-1 MIGRATED to testing (Debian testing watch)
[2010-03-12] Accepted libnet-oauth-perl 0.22-1 (source all) (Jonathan Yu) (signed by: gregor herrmann)
[2009-12-11] libnet-oauth-perl 0.20-1 MIGRATED to testing (Debian testing watch)
[2009-11-30] Accepted libnet-oauth-perl 0.20-1 (source all) (Jonathan Yu) (signed by: gregor herrmann)
[2009-07-10] libnet-oauth-perl 0.19-1 MIGRATED to testing (Debian testing watch)
[2009-06-29] Accepted libnet-oauth-perl 0.19-1 (source all) (gregor herrmann)

1
2

bugs [bug history graph]

all: 0

links

homepage
lintian
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 0.33-1

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing