Date: Thu, 20 Feb 2014 00:10:25 -0500 (EST) From: cve-assign@...re.org To: vdanen@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request for CGI::Application information disclosure flaw -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > it would unexpectedly dump a complete set of web query data and server > environment information as an error page > https://rt.cpan.org/Public/Bug/Display.html?id=84403 > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739505 > https://github.com/markstos/CGI--Application/pull/15 > https://github.com/markstos/CGI--Application/commit/61d327646f01fe > https://bugzilla.redhat.com/show_bug.cgi?id=1067180 > until 2008, if you overloaded setup() - which everyone does - you had > NO start->dump_html default at all in run_mode! > > After the change, you ALWAYS have dump_html as a default run_mode > unless you explicitly redefine it in your code. > > Behaviour of an otherwise unmodified application changed due to an > update of Application.pm. Data that should not be shown AND was not > shown when using versions before v4.19 was now on screen. Customers > were not amused. Use CVE-2013-7329. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTBYznAAoJEKllVAevmvms7eIH/2A2wmKR1/15a9WPmC2pgyFD Ees3KWHHcKXGf/5gXy+ci2e0BPTH61R+k5sJqk3ljHfKGDjsy+4bdFvzoaroM/q5 NduEjXJHC/+RIsYoZ1ZdXUZbjwa7zDqeaqvcPjy6kQmeinYT4VYHkYioxvveCCZ6 KomoKkpSfFt01ddsPumw99CVB44yFuhBqfTjCilyJAFqHpMzqxq2JSMbcXwIB1v6 EBsUnFS0f6mG5iR1yNJbfpUCD5xoOtyty7GtIaGFAvB8jxZn3JZFQzGQ4rTZLh8J Xs0IGtMEVA6jP3vdo8LTlQAzvrzgMkMPdbGn0ICSr0O2CW0U1unEMSeG4VugJUA= =Ge6r -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.