rpms/perl-HTTP-Daemon
7
0
Fork 0
Code Issues Pull Requests Releases Activity
Simple HTTP server class
4 Commits 12 Branches 18 Tags 110 KiB
Diff 100%
33172531b3
Go to file
RHEL Packaging Agent 33172531b3 Fix CVE-2026-8450: send_file() RCE via 2-arg open() shell-magic 
Backport upstream fix (commit 945d3514) for CVE-2026-8450 to
perl-HTTP-Daemon 6.01. The send_file() method in
HTTP::Daemon::ClientConn used the insecure 2-argument form of
open(), which allowed shell-magic interpretation of filenames
(pipe commands, redirections, etc.). The fix switches to
3-argument open() with an explicit '<' mode, replacing the
typeglob with a lexical filehandle. Additional hardening
includes proper binmode() failure handling and a '0E0'
true-zero return for empty successful transfers.

CVE: CVE-2026-8450
Upstream patches:
 - 945d35141d.patch
Resolves: RHEL-184825

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-06-17 09:02:09 +00:00
.gitignore Import rpm: c8s 2023-02-27 14:49:59 -05:00
HTTP-Daemon-6.01-Add-IPv6-support.patch Auto sync2gitlab import of perl-HTTP-Daemon-6.01-23.el8.src.rpm 2022-05-26 12:59:49 -04:00
HTTP-Daemon-6.01-CVE-2026-8450.patch Fix CVE-2026-8450: send_file() RCE via 2-arg open() shell-magic 2026-06-17 09:02:09 +00:00
HTTP-Daemon-6.01-Handle-undef-and-empty-LocalAddr.patch Auto sync2gitlab import of perl-HTTP-Daemon-6.01-23.el8.src.rpm 2022-05-26 12:59:49 -04:00
HTTP-Daemon-6.01-Resolve-specific-socket-addresses-correctly.patch Auto sync2gitlab import of perl-HTTP-Daemon-6.01-23.el8.src.rpm 2022-05-26 12:59:49 -04:00
perl-HTTP-Daemon.spec Fix CVE-2026-8450: send_file() RCE via 2-arg open() shell-magic 2026-06-17 09:02:09 +00:00
sources Auto sync2gitlab import of perl-HTTP-Daemon-6.01-23.el8.src.rpm 2022-05-26 12:59:49 -04:00