After some miscommunication between various vendors and perl5-porters regarding a security issue in the Perl (5.8) Regular Expression engine, Nicholas Clark has announced perl5-security-report@perl.org as the mail address for reporting security issues with the Perl core.

This address is intended to be an address for reporting security issues with serious implications that you do not want to publish to a wider audience. It is not intended for reporting general (perceived or real) bugs with the Perl core or Perl modules.

Nicholas is looking for more subscribers to that list to get 99% reliability of a reply within 24 hours, 7 days a week, but I guess the criteria for subscribing to that list will be that you are in Good Standing with the Perl community and likely personally known and vouched for by at least one Perl committer.

The security problem that was briefly discussed in the CB seems to boil down to a vulnerability of your Perl program if you allow the user to submit regular expressions. All security announcements besides Nicholas' mail seem to be quite vague about the exact nature of the problem and I haven't looked at the code. The problem is already fixed in the Perl 5.10 engine, so if an upgrade or a patch to to 5.8.x is not in your plans, you can roll up this fix into your upgrade to Perl 5.10.

In reply to Central mail address for reporting security issues with the Perl core (perl5-security-report@perl.org) by Corion

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.