rpms/perl-HTTP-Daemon
7
0
Fork 0
Code Issues Pull Requests Releases Activity
Simple HTTP server class
6 Commits 13 Branches 22 Tags 142 KiB
Diff 100%
96003c11df
Go to file
RHEL Packaging Agent 96003c11df Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() 
Backport fix for CVE-2026-8450 to perl-HTTP-Daemon.
HTTP::Daemon::ClientConn::send_file() used 2-arg open() which
allowed shell-magic interpretation of filenames, enabling RCE
and arbitrary file write. The fix switches to 3-arg open() with
an explicit '<' mode so filenames are treated as literal paths.

A new patch perl-HTTP-Daemon-6.12-CVE-2026-8450.patch was added,
combining two upstream commits: 945d351 (the send_file() fix with
hardened binmode handling and '0E0' return value) and de619f3
(regression tests for shell-magic filename shapes).

CVE: CVE-2026-8450
Upstream patches:
 - 945d35141d.patch
 - de619f3eb8.patch
Resolves: RHEL-184822

This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.

Assisted-by: Ymir
2026-08-11 13:14:46 +00:00
.gitignore RHEL 9.0.0 Alpha bootstrap 2020-10-14 12:57:51 -07:00
HTTP-Daemon-6.04-EU-MM-is-not-deprecated.patch RHEL 9.0.0 Alpha bootstrap 2020-10-14 12:57:51 -07:00
perl-HTTP-Daemon-6.12-CVE-2026-8450.patch Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() 2026-08-11 13:14:46 +00:00
perl-HTTP-Daemon.spec Fix CVE-2026-8450: send_file() shell-magic injection via 2-arg open() 2026-08-11 13:14:46 +00:00
sources RHEL 9.0.0 Alpha bootstrap 2020-10-14 12:57:51 -07:00