CVE-2012-5526 CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applicatio...
MediumCVSS 5.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libcgi-pm-perl(Debian:12) | < 3.61-2 | 3.61-2 |
| debian/libcgi-pm-perl(Debian:13) | < 3.61-2 | 3.61-2 |
| debian/libcgi-pm-perl(Debian:14) | < 3.61-2 | 3.61-2 |
| debian/perl(Debian:12) | < 5.14.2-16 | 5.14.2-16 |
| debian/perl(Debian:13) | < 5.14.2-16 | 5.14.2-16 |
| debian/perl(Debian:14) | < 5.14.2-16 | 5.14.2-16 |
| andy armstrong cgi.pm | <= 3.62 | No fix listed |
References
- Debian Security Tracker CVE-2012-5526 vendor-advisory
- cpansearch.perl.org
- kb.juniper.net
- kb.juniper.net
- RHSA-2013:0685 vendor-advisory
- 51457 third-party-advisory
- 55314 third-party-advisory
- DSA-2586 vendor-advisory
- [oss-security] 20121115 Re: CVE Request -- perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers mailing-list
- www.oracle.com
- 56562 vdb-entry
- 1027780 vdb-entry
- USN-1643-1 vendor-advisory
- perl-cgipm-header-injection(80098) vdb-entry
- github.com
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking