CVE-2015-10149 Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine
Unknown
- Published
- Updated
- Exploit status
- No public exploit known
Description
Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.
read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the session engine to load the session.
A remote attacker may cause path traversal or injection in a session engine that uses the id in a file path, cache command or query without checking it.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cpan Dancer | < 1.3400 | 1.3400 |
| debian/libdancer-perl(Debian:12) | < 1.3400+dfsg-1 | 1.3400+dfsg-1 |
| debian/libdancer-perl(Debian:13) | < 1.3400+dfsg-1 | 1.3400+dfsg-1 |
| debian/libdancer-perl(Debian:14) | < 1.3400+dfsg-1 | 1.3400+dfsg-1 |
References
- github.com patch
- github.com issue-tracking
- github.com issue-tracking
- github.com issue-tracking
- metacpan.org release-notes
- security-tracker.debian.org vendor-advisory
- www.openwall.com