oss-sec mailing list archives
Re: CVE request for CGI::Application information disclosure flaw
From: cve-assign () mitre org
Date: Thu, 20 Feb 2014 00:10:25 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
it would unexpectedly dump a complete set of web query data and server environment information as an error page
https://rt.cpan.org/Public/Bug/Display.html?id=84403 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739505 https://github.com/markstos/CGI--Application/pull/15 https://github.com/markstos/CGI--Application/commit/61d327646f01fe https://bugzilla.redhat.com/show_bug.cgi?id=1067180
until 2008, if you overloaded setup() - which everyone does - you had NO start->dump_html default at all in run_mode! After the change, you ALWAYS have dump_html as a default run_mode unless you explicitly redefine it in your code. Behaviour of an otherwise unmodified application changed due to an update of Application.pm. Data that should not be shown AND was not shown when using versions before v4.19 was now on screen. Customers were not amused.
Use CVE-2013-7329. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTBYznAAoJEKllVAevmvms7eIH/2A2wmKR1/15a9WPmC2pgyFD Ees3KWHHcKXGf/5gXy+ci2e0BPTH61R+k5sJqk3ljHfKGDjsy+4bdFvzoaroM/q5 NduEjXJHC/+RIsYoZ1ZdXUZbjwa7zDqeaqvcPjy6kQmeinYT4VYHkYioxvveCCZ6 KomoKkpSfFt01ddsPumw99CVB44yFuhBqfTjCilyJAFqHpMzqxq2JSMbcXwIB1v6 EBsUnFS0f6mG5iR1yNJbfpUCD5xoOtyty7GtIaGFAvB8jxZn3JZFQzGQ4rTZLh8J Xs0IGtMEVA6jP3vdo8LTlQAzvrzgMkMPdbGn0ICSr0O2CW0U1unEMSeG4VugJUA= =Ge6r -----END PGP SIGNATURE-----
Current thread:
- CVE request for CGI::Application information disclosure flaw Vincent Danen (Feb 19)
- Re: CVE request for CGI::Application information disclosure flaw cve-assign (Feb 19)