Bug 657950 - perl-5.12.2/CGI-3.50 security update
Summary: perl-5.12.2/CGI-3.50 security update
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: perl
Version: 14
Hardware: Unspecified
OS: Unspecified
low
high
Target Milestone: ---
Assignee: Marcela Mašláňová
QA Contact: Fedora Extras Quality Assurance
URL: http://www.nntp.perl.org/group/perl.p...
Whiteboard:
Depends On: 658125
Blocks: CVE-2010-2761, CVE-2010-4410 671352
TreeView+ depends on / blocked
 
Reported: 2010-11-28 21:40 UTC by Petr Pisar
Modified: 2011-02-22 18:46 UTC (History)
9 users (show)

Fixed In Version: perl-5.10.1-121.fc13
Doc Type: Bug Fix
Doc Text:
Clone Of:
: 671352 (view as bug list)
Environment:
Last Closed: 2010-12-05 00:35:52 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Petr Pisar 2010-11-28 21:40:48 UTC
Current perl-5.12.2 contains CGI 3.49 version. Upstream released new bug-fixing version 3.50 concerning MIME part construction and HTTP headers parser with security impacts. Changelog quotation:

Version 3.50
  
  [SECURITY]
  1. The MIME boundary in multipart_init is now random. 
     Thanks to Byron Jones, Masahiro Yamada, Reed Loden, and  Mark Stosberg
  2. Further improvements to handling of newlines embedded in header values. 
     An exception is thrown if header values contain invalid newlines. 
     Thanks to Michal Zalewski, Max Kanat-Alexander, Yanick Champoux,
     Lincoln Stein, Frédéric Buclin and Mark Stosberg


Affected: F15, F14 at least. Need to test Fedoras with older perl.

Solution:
CGI module will be forked into dual-lived package to allow isolated CGI module upgrade.

Comment 1 Fedora Update System 2010-12-01 13:19:25 UTC
perl-CGI-3.50-1.fc14,perl-5.12.2-140.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/perl-CGI-3.50-1.fc14,perl-5.12.2-140.fc14

Comment 2 Fedora Update System 2010-12-01 15:06:23 UTC
perl-5.10.1-121.fc13,perl-CGI-3.50-2.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/perl-5.10.1-121.fc13,perl-CGI-3.50-2.fc13

Comment 3 Fedora Update System 2010-12-01 21:58:23 UTC
perl-5.10.1-121.fc13, perl-CGI-3.50-2.fc13 has been pushed to the Fedora 13 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update perl perl-CGI'.  You can provide feedback for this update here: https://admin.fedoraproject.org/updates/perl-5.10.1-121.fc13,perl-CGI-3.50-2.fc13

Comment 4 Fedora Update System 2010-12-05 00:35:47 UTC
perl-5.12.2-140.fc14, perl-CGI-3.50-2.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 5 Fedora Update System 2011-01-21 10:41:44 UTC
perl-CGI-3.51-1.fc14 has been submitted as an update for Fedora 14.
https://admin.fedoraproject.org/updates/perl-CGI-3.51-1.fc14

Comment 6 Fedora Update System 2011-01-21 10:42:04 UTC
perl-CGI-3.51-1.fc13 has been submitted as an update for Fedora 13.
https://admin.fedoraproject.org/updates/perl-CGI-3.51-1.fc13

Comment 7 Fedora Update System 2011-01-31 19:51:55 UTC
perl-CGI-3.51-1.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2011-01-31 19:57:44 UTC
perl-CGI-3.51-1.fc14 has been pushed to the Fedora 14 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2011-02-22 18:46:27 UTC
perl-5.10.1-121.fc13, perl-CGI-3.50-2.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.