Re: [BLFS Trac] #23327: HTTP-Daemon-6.17 (Perl module)

#23327: HTTP-Daemon-6.17 (Perl module)
-------------------------+------------------------
 Reporter:  Bruce Dubbs  |       Owner:  blfs-book
     Type:  enhancement  |      Status:  new
 Priority:  elevated     |   Milestone:  13.1
Component:  BOOK         |     Version:  git
 Severity:  normal       |  Resolution:
 Keywords:               |
-------------------------+------------------------
Comment (by Bruce Dubbs):

 I installed this with 'cpan -i HTTP::Daemon'.

 The changes file says:

 6.17      2026-05-19 23:11:06Z
   - Fix CVE-2026-8450 (affects 6.15 and earlier): 2-arg open() in
     send_file() enabled RCE / arbitrary file write / response-body
     exfiltration when a string argument was derived from attacker-
     influenced input. send_file() now uses 3-arg open() with an
     explicit '<' read mode, so the path is always treated as a literal
     filename and 2-arg open() shell-magic shapes ('| cmd', 'cmd |',
     '> path', etc.) are no longer interpreted. send_file() now also
     returns '0E0' (true zero) on a successful zero-byte transfer so
     callers can distinguish empty file from open failure (undef). See
     https://www.cve.org/CVERecord?id=CVE-2026-8450 for the advisory.
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23327#comment:3>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page