rpms/perl-HTTP-Daemon
7
0
Fork 0
Code Issues Pull Requests Releases Activity
Simple HTTP server class
76 Commits 13 Branches 22 Tags 142 KiB
Diff 100%
73c2c63253
Go to file
RHEL Packaging Agent 73c2c63253 Fix CVE-2026-8450: send_file() RCE via 2-arg open() shell-magic 
Backport upstream fix (commit 945d351) for CVE-2026-8450 in
perl-HTTP-Daemon. The send_file() method used 2-arg open()
which allowed shell-magic interpretation of filenames (pipe
commands, redirections), enabling RCE and arbitrary file write
when filenames were derived from attacker-controlled input.
The fix switches to 3-arg open() with explicit '<' mode,
adds binmode error handling, and returns '0E0' for
empty-but-successful transfers.

CVE: CVE-2026-8450
Upstream patches:
 - 945d35141d.patch
Resolves: RHEL-184821

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-05 13:11:57 +00:00
.fmf Package tests 2022-03-04 13:09:53 +01:00
plans Package tests 2022-03-04 13:09:53 +01:00
tests Update tests and gating.yaml 2024-07-09 17:14:58 +02:00
.gitignore 6.16 bump 2023-02-24 10:16:16 +01:00
gating.yaml Update tests and gating.yaml 2024-07-09 17:14:58 +02:00
HTTP-Daemon-6.04-EU-MM-is-not-deprecated.patch 6.15 bump 2023-02-23 21:24:51 +01:00
perl-HTTP-Daemon-6.16-CVE-2026-8450.patch Fix CVE-2026-8450: send_file() RCE via 2-arg open() shell-magic 2026-08-05 13:11:57 +00:00
perl-HTTP-Daemon.rpmlintrc Package tests 2022-03-04 13:09:53 +01:00
perl-HTTP-Daemon.spec Fix CVE-2026-8450: send_file() RCE via 2-arg open() shell-magic 2026-08-05 13:11:57 +00:00
sources 6.16 bump 2023-02-24 10:16:16 +01:00