CVE-2012-5572 CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks vi...
MediumCVSS 5.0
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libdancer-perl(Debian:12) | < 1.3114+dfsg-1 | 1.3114+dfsg-1 |
| debian/libdancer-perl(Debian:13) | < 1.3114+dfsg-1 | 1.3114+dfsg-1 |
| debian/libdancer-perl(Debian:14) | < 1.3114+dfsg-1 | 1.3114+dfsg-1 |
| dancer | <= 1.3113 | No fix listed |
| dancer | = 1.150 | No fix listed |
| dancer | = 1.3060 | No fix listed |
| dancer | = 1.3071 | No fix listed |
| dancer | = 1.3079_3 | No fix listed |
| dancer | = 1.3079_5 | No fix listed |
| dancer | = 1.3110 | No fix listed |
| dancer | = 1.3111 | No fix listed |
| dancer | = 1.3111_01 | No fix listed |
| dancer | = 1.3112 | No fix listed |
References
- Debian Security Tracker CVE-2012-5572 vendor-advisory
- advisories.mageia.org
- MDVSA-2013:184 vendor-advisory
- [oss-security] 20121126 Re: CVE Request -- Dancer.pm / perl-Dancer / libdancer-perl: Newline injection due to improper CRLF escaping in cookie() and cookies() methods (different vulnerability than CVE-2012-5526) mailing-list
- github.com
- github.com
- FEDORA-2013-9950 vendor-advisory
- bugs.debian.org issue-tracking