Bug 494402 (CVE-2009-0796) - CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
Summary: CVE-2009-0796 httpd mod_perl Apache::Status XSS flaw
Alias: CVE-2009-0796
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 544455
TreeView+ depends on / blocked
Reported: 2009-04-06 18:06 UTC by Josh Bressers
Modified: 2021-11-12 19:56 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2011-08-15 19:12:09 UTC

Attachments (Terms of Use)

Description Josh Bressers 2009-04-06 18:06:00 UTC
A flaw was found in the httpd mod_perl Apache::Status module. If a site has the non default setting of making /perl-status page accessible, remote attackers could use that flaw to trick users or steal sensitive browser data.

The original public announcement can be found here:

The CVE id mentioned in the above mail is wrong, CVE-2009-0796 is the proper CVE id.

Comment 3 Jan Lieskovsky 2009-06-10 18:08:51 UTC
The Red Hat Security Response Team has rated this issue as having moderate security impact, a future mod_perl package update may address this
flaw. More information regarding issue severity can be found here:

The vulnerability affects non default configuration of Apache HTTP web
server, i.e cases, when access to Apache::Status and Apache2::Status
resources is explicitly allowed via <Location /perl-status> httpd.conf  configuration directive.
   Its occurrence can be prevented by using the default configuration
for the Apache HTTP web server (not exporting /perl-status).

Comment 4 Vincent Danen 2009-12-04 22:34:20 UTC
This also affects all current Fedora releases (10, 11, 12, and rawhide).

Comment 6 Joe Orton 2009-12-08 17:02:51 UTC
Upstream trunk commit:


Comment 8 Vincent Danen 2011-06-17 19:32:32 UTC
This was fixed in Fedora a while ago:

* Tue Dec 08 2009 Joe Orton <jorton@redhat.com> - 2.0.4-10
- add security fix for CVE-2009-0796 (#544455)

Comment 9 Josh Bressers 2011-08-15 19:12:09 UTC
I'm closing this as wontfix. It's fixed in newer versions of mod_perl, the actual threat here is very minimal.

Note You need to log in before you can comment on or make changes to this bug.