Description
CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcgi-pm-perl | 3.50-1 | — |
| Debian 14 | libcgi-simple-perl | 1.111-2 | — |
| Debian 14 | perl | 5.10.1-17 | — |
| Debian 13 | libcgi-pm-perl | 3.50-1 | — |
| Debian 13 | libcgi-simple-perl | 1.111-2 | — |
| Debian 13 | perl | 5.10.1-17 | — |
| Debian 12 | libcgi-pm-perl | 3.50-1 | — |
| Debian 12 | libcgi-simple-perl | 1.111-2 | — |
| Debian 12 | perl | 5.10.1-17 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perl +3 | 4:5.10.1-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Archive-Extract | 1:0.38-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Archive-Tar | 1.58-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-CGI | 3.51-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-CPAN | 1.9402-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-CPANPLUS | 0.88-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Compress-Raw-Zlib | 2.023-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Compress-Zlib +2 | 2.020-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Digest-SHA | 1:5.47-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-CBuilder | 1:0.27-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-Embed | 1.28-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-MakeMaker | 6.55-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-ExtUtils-ParseXS | 1:2.2003.0-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-File-Fetch | 0.26-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-IO-Zlib | 1:1.09-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-IPC-Cmd | 1:0.56-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Locale-Maketext-Simple | 1:0.18-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Log-Message +2 | 1:0.02-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Log-Message-Simple | 0.04-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Build | 1:0.3500-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-CoreList | 2.18-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Load | 1:0.16-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Load-Conditional | 0.30-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Module-Pluggable | 1:3.90-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Object-Accessor | 1:0.34-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Params-Check | 1:0.26-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Parse-CPAN-Meta | 1:1.40-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Pod-Escapes | 1:1.04-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Pod-Simple | 1:3.13-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Term-UI | 0.20-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Test-Harness | 3.17-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Test-Simple | 0.92-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Time-HiRes | 4:1.9721-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-Time-Piece | 1.15-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-core | 5.10.1-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-parent | 1:0.221-119.el6 | RHSA-2011:0558 |
| RHEL 6 | perl-version | 3:0.77-119.el6 | RHSA-2011:0558 |
| RHEL 5 | perl +1 | 4:5.8.8-32.el5_7.6 | RHSA-2011:1797 |
| RHEL 4 | perl +1 | 3:5.8.5-57.el4 | RHSA-2011:1797 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl | 5.24.0-3.5 | openSUSE-SU-2024:10449-1 |
| openSUSE Tumbleweed | perl-CGI-Simple | 1.115-1.4 | openSUSE-SU-2024:10545-1 |
Advisories 4
- RHSA-2011:1797 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2011:0558 Red Hat Security Advisory: perl security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10449-1 perl-32bit-5.24.0-3.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10545-1 perl-CGI-Simple-1.115-1.4 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm
- RHSA-2011:1797 vendor-advisory
- FEDORA-2011-0653 vendor-advisory
- 43068 third-party-advisory
- [oss-security] 20101201 Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) mailing-list
- [oss-security] 20101201 Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) mailing-list
- ADV-2011-0212 vdb-entry
- MDVSA-2010:252 vendor-advisory
- 44199 vdb-entry
- SUSE-SR:2011:005 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=658970
- SUSE-SR:2011:002 vendor-advisory
- http://perl5.git.perl.org/perl.git/commit/84601d63a7e34958da47dad1e61e27cb3bd467d1
- ADV-2010-3230 vdb-entry
- ADV-2011-0249 vdb-entry
- 45145 vdb-entry
- http://www.nntp.perl.org/group/perl.perl5.changes/2010/11/msg28043.html
- MDVSA-2010:237 vendor-advisory
- [oss-security] 20101201 CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part) mailing-list
- http://cpansearch.perl.org/src/LDS/CGI.pm-3.50/Changes
- FEDORA-2011-0631 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 43147 third-party-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735