Backport upstream fix (commit 945d351) for CVE-2026-8450 in
perl-HTTP-Daemon. The send_file() method used 2-arg open()
which allowed shell-magic interpretation of filenames (pipe
commands, redirections), enabling RCE and arbitrary file write
when filenames were derived from attacker-controlled input.
The fix switches to 3-arg open() with explicit '<' mode,
adds binmode error handling, and returns '0E0' for
empty-but-successful transfers.
CVE: CVE-2026-8450
Upstream patches:
- 945d35141d.patch
Resolves: RHEL-184821
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
