Security Advisories (3)
CVE-2017-0373 (2017-05-10)

The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous "use lib" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file.

CPANSA-Config-Model-2017-01 (2017-05-10)

YAML or YAML::XS can be loaded automatically making it possible to run arbitrary code loading a specially crafted YAML file.

CVE-2017-0374 (2017-05-10)

Loads models from a local directory, making it possible to substitute the model.

Installation

Debian or Ubuntu

cme and most Config::Model modules are provided as Debian package. The following command will install the framework and all available models and UIs:

sudo apt-get install --install-recommends --install-suggests cme

Mac OSX

Config::Model is provided as ppm package by ActiveState:

Windows

You can also install Config::Model from ActiveState. See the instructions for Mac OSX for details.

Fedora

Config::Model rpm on Fedora is severely oudated. See below for installation.

Other systems

For other systems, you should install Config::Model from CPAN:

cpanp install App::Cme
cpanp install Config::Model