Bug 876974
| Summary: | CVE-2012-5526 perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers [fedora-all] | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Petr Pisar <ppisar> | ||||
| Component: | perl-CGI | Assignee: | Petr Pisar <ppisar> | ||||
| Status: | CLOSED CURRENTRELEASE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 17 | CC: | jlieskov, mmaslano, perl-devel | ||||
| Target Milestone: | --- | Keywords: | Reopened | ||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| URL: | http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2012-12-18 02:24:31 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 877015 | ||||||
| Attachments: |
|
||||||
|
Description
Petr Pisar
2012-11-15 12:40:35 UTC
Created attachment 645610 [details]
Upstream fix
perl-CGI-3.51-9.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/perl-CGI-3.51-9.fc18 perl-CGI-3.51-6.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/perl-CGI-3.51-6.fc17 perl-CGI-3.51-5.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/perl-CGI-3.51-5.fc16 Package perl-CGI-3.51-9.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing perl-CGI-3.51-9.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-18287/perl-CGI-3.51-9.fc18 then log in and leave karma (feedback). perl-CGI-3.51-10.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/perl-CGI-3.51-10.fc18 perl-CGI-3.51-10.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. Bug in bodhi. It closed this report despite F17 and F16 builds have not yet reached stable repository. We distributed newer CGI module (perl-CGI-3.52) with perl. I need to upgrade standalone perl-CGI to 3.52 version and apply the fix on top make highest version available to users. perl-CGI-3.59-235.fc18,perl-5.16.2-235.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/perl-CGI-3.59-235.fc18,perl-5.16.2-235.fc18 perl-CGI-3.52-218.fc17,perl-5.14.3-218.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/perl-CGI-3.52-218.fc17,perl-5.14.3-218.fc17 Package perl-CGI-3.59-235.fc18, perl-5.16.2-235.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing perl-CGI-3.59-235.fc18 perl-5.16.2-235.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-19125/perl-CGI-3.59-235.fc18,perl-5.16.2-235.fc18 then log in and leave karma (feedback). perl-CGI-3.51-7.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. Bug in bodhi. It closed this report despite F17 and F16 builds have not yet reached stable repository. perl-CGI-3.59-235.fc18, perl-5.16.2-235.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report. Bug in bodhi. F16 and F17 is still in testing phase. perl-CGI-3.52-218.fc17, perl-5.14.3-218.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report. Bug in bodhi. F16 is still in testing phase. perl-CGI-3.52-203.fc16, perl-5.14.3-203.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. |