Description
HTTP::Body::Multipart in the HTTP-Body module for Perl (1.07 through 1.22, before 1.23) uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libhttp-body-perl | 1.17-2 | — |
| Debian 13 | libhttp-body-perl | 1.17-2 | — |
| Debian 12 | libhttp-body-perl | 1.17-2 | — |
| Debian 7 | libhttp-body-perl | 1.11-1+deb7u1 | DSA-2801-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | perl-HTTP-Body | 1.22-1.4 | openSUSE-SU-2024:10492-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | perl-http-body | 1.22-r4 | — |
| Alpine v3.18 | perl-http-body | 1.22-r3 | — |
| Alpine v3.17 | perl-http-body | 1.22-r2 | — |
| Alpine v3.16 | perl-http-body | 1.22-r2 | — |
Advisories 2
- DSA-2801-1 libhttp-body-perl - design error Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10492-1 perl-HTTP-Body-1.22-1.4 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634
- http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00018.html
- http://www.debian.org/security/2013/dsa-2801
- https://metacpan.org/release/GETTY/HTTP-Body-1.23/
- https://www.openwall.com/lists/oss-security/2024/04/07/1
- http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=13ac5b23c083bc56e32dd706ca02fca292bd2161
- http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits/HTTP-Body.git%3Ba=commit%3Bh=cc75c886256f187cda388641931e8dafad6c2346
- [oss-security] 20240407 HTTP::Body before 1.23 for Perl is still vulnerable to CVE-2013-4407 mailing-list