Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Bug ID: 876974 Summary: CGI::header() does not escape new lines in cookie value Product: Fedora Version: 17 Component: perl-CGI Severity: high Priority: unspecified Reporter: ppisar@redhat.com Type: Bug
$ cat test #!/usr/bin/perl use strict; use warnings; use CGI qw/header/;
print header( -cookie => [ "foo\nbar\nbaz", ], -p3p => [ "foo\nbar\nbaz", ], );
$ ./test P3P: policyref="/w3c/p3p.xml", CP="foo bar baz" Set-Cookie: foo bar baz Date: Thu, 15 Nov 2012 12:23:39 GMT Content-Type: text/html; charset=ISO-8859-1
Fixed in upstream CGI-3.63.
F<19 are affected.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #1 from Petr Pisar ppisar@redhat.com --- Created attachment 645610 --> https://bugzilla.redhat.com/attachment.cgi?id=645610&action=edit Upstream fix
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://bugzilla.redhat.com | |/show_bug.cgi?id=876951
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #2 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.51-9.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/perl-CGI-3.51-9.fc18
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #3 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.51-6.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/perl-CGI-3.51-6.fc17
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #4 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.51-5.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/perl-CGI-3.51-5.fc16
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Jan Lieskovsky jlieskov@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |877015
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Jan Lieskovsky jlieskov@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |jlieskov@redhat.com Summary|CGI::header() does not |perl-CGI: Newline injection |escape new lines in cookie |due to improper CRLF |value |escaping in Set-Cookie and | |P3P headers [fedora-all]
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #5 from Fedora Update System updates@fedoraproject.org --- Package perl-CGI-3.51-9.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing perl-CGI-3.51-9.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-18287/perl-CGI-3.51-9.fc... then log in and leave karma (feedback).
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #6 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.51-10.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/perl-CGI-3.51-10.fc18
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Jan Lieskovsky jlieskov@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Summary|perl-CGI: Newline injection |CVE-2012-5526 perl-CGI: |due to improper CRLF |Newline injection due to |escaping in Set-Cookie and |improper CRLF escaping in |P3P headers [fedora-all] |Set-Cookie and P3P headers | |[fedora-all]
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE Last Closed| |2012-11-23 02:54:03
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #7 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.51-10.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |ASSIGNED Resolution|CURRENTRELEASE |--- Keywords| |Reopened
--- Comment #8 from Petr Pisar ppisar@redhat.com --- Bug in bodhi. It closed this report despite F17 and F16 builds have not yet reached stable repository.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |ASSIGNED
--- Comment #9 from Petr Pisar ppisar@redhat.com --- We distributed newer CGI module (perl-CGI-3.52) with perl. I need to upgrade standalone perl-CGI to 3.52 version and apply the fix on top make highest version available to users.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #10 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.59-235.fc18,perl-5.16.2-235.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/perl-CGI-3.59-235.fc18,perl-5.16.2-2...
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #11 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.52-218.fc17,perl-5.14.3-218.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/perl-CGI-3.52-218.fc17,perl-5.14.3-2...
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #12 from Fedora Update System updates@fedoraproject.org --- Package perl-CGI-3.59-235.fc18, perl-5.16.2-235.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing perl-CGI-3.59-235.fc18 perl-5.16.2-235.fc18' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-19125/perl-CGI-3.59-235.... then log in and leave karma (feedback).
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE Last Closed|2012-11-23 02:54:03 |2012-11-28 06:36:05
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #13 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.51-7.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |ASSIGNED Resolution|CURRENTRELEASE |--- Keywords| |Reopened
--- Comment #14 from Petr Pisar ppisar@redhat.com --- Bug in bodhi. It closed this report despite F17 and F16 builds have not yet reached stable repository.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE Last Closed|2012-11-28 06:36:05 |2012-12-11 19:28:04
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #15 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.59-235.fc18, perl-5.16.2-235.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |ASSIGNED Resolution|CURRENTRELEASE |---
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |ON_QA
--- Comment #16 from Petr Pisar ppisar@redhat.com --- Bug in bodhi. F16 and F17 is still in testing phase.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE Last Closed|2012-12-11 19:28:04 |2012-12-13 00:54:44
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #17 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.52-218.fc17, perl-5.14.3-218.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |ASSIGNED Resolution|CURRENTRELEASE |---
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Petr Pisar ppisar@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |ON_QA
--- Comment #18 from Petr Pisar ppisar@redhat.com --- Bug in bodhi. F16 is still in testing phase.
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
Fedora Update System updates@fedoraproject.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |CURRENTRELEASE Last Closed|2012-12-13 00:54:44 |2012-12-17 21:24:31
Product: Fedora https://bugzilla.redhat.com/show_bug.cgi?id=876974
--- Comment #19 from Fedora Update System updates@fedoraproject.org --- perl-CGI-3.52-203.fc16, perl-5.14.3-203.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
perl-devel@lists.fedoraproject.org