Debian has issued an advisory today (November 21): http://lists.debian.org/debian-security-announce/2013/msg00214.html RedHat has rated this as a high severity issue: https://bugzilla.redhat.com/show_bug.cgi?id=1005669 A patch was written by a Debian developer, there's a link to the commit here: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634 Patched packages uploaded for Mageia 2, Mageia 3, and Cauldron. Advisory: ======================== Updated perl-HTTP-Body package fixes security vulnerability: Jonathan Dolle reported a design error in HTTP::Body, a Perl module for processing data from HTTP POST requests. The HTTP body multipart parser creates temporary files which preserve the suffix of the uploaded file. An attacker able to upload files to a service that uses HTTP::Body::Multipart could potentially execute commands on the server if these temporary filenames are used in subsequent commands without further checks (CVE-2013-4407). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4407 http://www.debian.org/security/2013/dsa-2801 ======================== Updated packages in core/updates_testing: ======================== perl-HTTP-Body-1.150.0-1.1.mga2 perl-HTTP-Body-1.170.0-2.1.mga3 from SRPMS: perl-HTTP-Body-1.150.0-1.1.mga2.src.rpm perl-HTTP-Body-1.170.0-2.1.mga3.src.rpm Reproducible: Steps to Reproduce:
CC: (none) => jquelinWhiteboard: (none) => MGA2TOO
Just checking that the sample script on cpan doesn't cause errors http://search.cpan.org/~getty/HTTP-Body-1.17/lib/HTTP/Body.pm It actually does error due to it missing a ; after $body->param_order towards the end, but when that is fixed..
Whiteboard: MGA2TOO => MGA2TOO has_procedure
Testing complete mga2 32 & 64 and mga3 32 & 64
Validating. Advisory uploaded. Could sysadmin please push from 2&3 core/updates_testing to updates Thanks!
Keywords: (none) => validated_updateWhiteboard: MGA2TOO has_procedure => MGA2TOO has_procedure advisory mga2-32-ok mga2-64-ok mga3-32-ok mga3-64-okCC: (none) => sysadmin-bugs
URL: (none) => http://lwn.net/Vulnerabilities/574751/
Update pushed: http://advisories.mageia.org/MGASA-2013-0352.html
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED