PT-2018-19287 · Perl · Http::Entity::Parser+2
Publicado
2018-11-03
·
Atualizado
2018-11-03
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
Name of the Vulnerable Software and Affected Versions
Dancer2 versions prior to 0.206000
Description
A potential remote code execution (RCE) issue exists due to a problem with Storable. To address this, Dancer2 now includes session ID validation in its session engine, allowing session backends based on Storable to reject malformed session IDs that could be exploited. The parsing of requests has been improved by using HTTP::Entity::Parser, reducing the amount of code required and eliminating the need for re-parsing the request body.
Recommendations
For versions prior to 0.206000, update to version 0.206000 or later to fix the issue.
As a temporary workaround, consider disabling the use of Storable-based session backends until a patch is available.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Dancer2
Http::Entity::Parser
Storable