[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201402200510.s1K5APxn013085@linus.mitre.org>
Date: Thu, 20 Feb 2014 00:10:25 -0500 (EST)
From: cve-assign@...re.org
To: vdanen@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for CGI::Application information disclosure flaw
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> it would unexpectedly dump a complete set of web query data and server
> environment information as an error page
> https://rt.cpan.org/Public/Bug/Display.html?id=84403
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739505
> https://github.com/markstos/CGI--Application/pull/15
> https://github.com/markstos/CGI--Application/commit/61d327646f01fe
> https://bugzilla.redhat.com/show_bug.cgi?id=1067180
> until 2008, if you overloaded setup() - which everyone does - you had
> NO start->dump_html default at all in run_mode!
>
> After the change, you ALWAYS have dump_html as a default run_mode
> unless you explicitly redefine it in your code.
>
> Behaviour of an otherwise unmodified application changed due to an
> update of Application.pm. Data that should not be shown AND was not
> shown when using versions before v4.19 was now on screen. Customers
> were not amused.
Use CVE-2013-7329.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTBYznAAoJEKllVAevmvms7eIH/2A2wmKR1/15a9WPmC2pgyFD
Ees3KWHHcKXGf/5gXy+ci2e0BPTH61R+k5sJqk3ljHfKGDjsy+4bdFvzoaroM/q5
NduEjXJHC/+RIsYoZ1ZdXUZbjwa7zDqeaqvcPjy6kQmeinYT4VYHkYioxvveCCZ6
KomoKkpSfFt01ddsPumw99CVB44yFuhBqfTjCilyJAFqHpMzqxq2JSMbcXwIB1v6
EBsUnFS0f6mG5iR1yNJbfpUCD5xoOtyty7GtIaGFAvB8jxZn3JZFQzGQ4rTZLh8J
Xs0IGtMEVA6jP3vdo8LTlQAzvrzgMkMPdbGn0ICSr0O2CW0U1unEMSeG4VugJUA=
=Ge6r
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
