Description
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libdancer-perl | 1.3114+dfsg-1 | — |
| Debian 13 | libdancer-perl | 1.3114+dfsg-1 | — |
| Debian 12 | libdancer-perl | 1.3114+dfsg-1 | — |
References
- FEDORA-2013-9950 vendor-advisory
- MDVSA-2013:184 vendor-advisory
- [oss-security] 20121126 Re: CVE Request -- Dancer.pm / perl-Dancer / libdancer-perl: Newline injection due to improper CRLF escaping in cookie() and cookies() methods (different vulnerability than CVE-2012-5526) mailing-list
- https://github.com/PerlDancer/Dancer/issues/859
- https://github.com/PerlDancer/Dancer/blob/devel/CHANGES
- http://advisories.mageia.org/MGASA-2013-0183.html