Description
CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libcgi-pm-perl | 3.61-2 | — |
| Debian 14 | perl | 5.14.2-16 | — |
| Debian 13 | libcgi-pm-perl | 3.61-2 | — |
| Debian 13 | perl | 5.14.2-16 | — |
| Debian 12 | libcgi-pm-perl | 3.61-2 | — |
| Debian 12 | perl | 5.14.2-16 | — |
| Debian 6.0 | libcgi-pm-perl | 3.49-1squeeze2 | DSA-2587-1 |
| Debian 6.0 | perl | 5.10.1-17squeeze4 | DSA-2586-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perl +3 | 4:5.10.1-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Archive-Extract | 1:0.38-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Archive-Tar | 1.58-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CGI | 3.51-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CPAN | 1.9402-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-CPANPLUS | 0.88-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Compress-Raw-Zlib | 1:2.020-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Compress-Zlib +4 | 2.020-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Digest-SHA | 1:5.47-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-CBuilder | 1:0.27-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-Embed | 1.28-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-MakeMaker | 6.55-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-ExtUtils-ParseXS | 1:2.2003.0-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-File-Fetch | 0.26-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-IO-Zlib | 1:1.09-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-IPC-Cmd | 1:0.56-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Locale-Maketext-Simple | 1:0.18-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Log-Message +2 | 1:0.02-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Log-Message-Simple | 0.04-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Build | 1:0.3500-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-CoreList | 2.18-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Load | 1:0.16-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Load-Conditional | 0.30-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Module-Pluggable | 1:3.90-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Object-Accessor | 1:0.34-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Params-Check | 1:0.26-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Parse-CPAN-Meta | 1:1.40-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Pod-Escapes | 1:1.04-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Pod-Simple | 1:3.13-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Term-UI | 0.20-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Test-Harness | 3.17-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Test-Simple | 0.92-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Time-HiRes | 4:1.9721-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-Time-Piece | 1.15-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-core | 5.10.1-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-parent | 1:0.221-130.el6_4 | RHSA-2013:0685 |
| RHEL 6 | perl-version | 3:0.77-130.el6_4 | RHSA-2013:0685 |
| RHEL 5 | perl +1 | 4:5.8.8-40.el5_9 | RHSA-2013:0685 |
Advisories 3
- RHSA-2013:0685 Red Hat Security Advisory: perl security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- DSA-2587-1 libcgi-pm-perl - HTTP header injection Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2586-1 perl - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- perl-cgipm-header-injection(80098) vdb-entry
- 55314 third-party-advisory
- 56562 vdb-entry
- http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes
- USN-1643-1 vendor-advisory
- 1027780 vdb-entry
- DSA-2586 vendor-advisory
- RHSA-2013:0685 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- https://github.com/markstos/CGI.pm/pull/23
- [oss-security] 20121115 Re: CVE Request -- perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers mailing-list
- 51457 third-party-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735