Date: Thu, 20 Feb 2014 00:10:25 -0500 (EST) From: cve-assign@...re.org To: vdanen@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request for CGI::Application information disclosure flaw -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > it would unexpectedly dump a complete set of web query data and server > environment information as an error page > https://rt.cpan.org/Public/Bug/Display.html?id=84403 > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739505 > https://github.com/markstos/CGI--Application/pull/15 > https://github.com/markstos/CGI--Application/commit/61d327646f01fe > https://bugzilla.redhat.com/show_bug.cgi?id=1067180 > until 2008, if you overloaded setup() - which everyone does - you had > NO start->dump_html default at all in run_mode! > > After the change, you ALWAYS have dump_html as a default run_mode > unless you explicitly redefine it in your code. > > Behaviour of an otherwise unmodified application changed due to an > update of Application.pm. Data that should not be shown AND was not > shown when using versions before v4.19 was now on screen. Customers > were not amused. Use CVE-2013-7329. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTBYznAAoJEKllVAevmvms7eIH/2A2wmKR1/15a9WPmC2pgyFD Ees3KWHHcKXGf/5gXy+ci2e0BPTH61R+k5sJqk3ljHfKGDjsy+4bdFvzoaroM/q5 NduEjXJHC/+RIsYoZ1ZdXUZbjwa7zDqeaqvcPjy6kQmeinYT4VYHkYioxvveCCZ6 KomoKkpSfFt01ddsPumw99CVB44yFuhBqfTjCilyJAFqHpMzqxq2JSMbcXwIB1v6 EBsUnFS0f6mG5iR1yNJbfpUCD5xoOtyty7GtIaGFAvB8jxZn3JZFQzGQ4rTZLh8J Xs0IGtMEVA6jP3vdo8LTlQAzvrzgMkMPdbGn0ICSr0O2CW0U1unEMSeG4VugJUA= =Ge6r -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ