Bug 439054 (CVE-2008-1532)

Summary:	CVE-2008-1532 Perlbal crashes upon empty buffered upload attempts
Product:	[Other] Security Response	Reporter:	Lubomir Kundrak <lkundrak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ruben
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-1532
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-04-03 09:28:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	439055, 439056
Bug Blocks:

Description Lubomir Kundrak 2008-03-26 18:19:20 UTC

Changelog for version 1.70 contains the following:

SECURITY: patch from Jeremey James <jbj.uk> to not crash
on zero byte chunked upload when buffered uploads are enabled.

References:

http://bugs.gentoo.org/show_bug.cgi?id=214784
http://search.cpan.org/src/BRADFITZ/Perlbal-1.70/CHANGES

Comment 2 Lubomir Kundrak 2008-03-26 19:43:55 UTC

CVE name was requested.

Comment 3 Lubomir Kundrak 2008-03-27 23:11:39 UTC

CVE-2008-1532

Comment 4 Fedora Update System 2008-03-28 13:57:26 UTC

Perlbal-1.70-1.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2008-03-28 13:58:12 UTC

Perlbal-1.70-1.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Red Hat Product Security 2008-04-03 09:28:38 UTC

This issue was addressed in:

  https://admin.fedoraproject.org/updates/F7/FEDORA-2008-2788
  https://admin.fedoraproject.org/updates/F8/FEDORA-2008-2778