pkgsrc-Changes archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
CVS commit: [pkgsrc-2026Q3] pkgsrc/www/p5-CGI
Module Name: pkgsrc
Committed By: maya
Date: Wed Nov 11 13:19:32 UTC 2026
Modified Files:
pkgsrc/www/p5-CGI [pkgsrc-2026Q3]: Makefile distinfo
Log Message:
Pullup ticket #7381 - requested by taca
www/p5-CGI: Security fix
Revisions pulled up:
- www/p5-CGI/Makefile 1.125
- www/p5-CGI/distinfo 1.75
---
Module Name: pkgsrc
Committed By: wiz
Date: Wed Nov 4 06:22:11 UTC 2026
Modified Files:
pkgsrc/www/p5-CGI: Makefile distinfo
Log Message:
p5-CGI: update to 5.02.
5.02 2026-11-03
[ RELEASE NOTES ]
- this is a security release fixing a large number of vulnerabilities,
several of them exploitable by any client against any script. all
users should upgrade
- to fix them some default behaviour has changed, see BREAKING CHANGES
below - most changes only affect malicious or malformed requests, but
please read them before upgrading. where a change could reasonably
affect a legitimate application an opt out or migration path is given
- the minimum *supported* perl version is now 5.10, however the dist
will still install for 5.8 (no guarantees about tests passing however)
[ SECURITY ]
- denial of service:
- CVE-2026-120631: CGI::Cookie->parse (and so CGI->cookie) used a
client supplied cookie expires value as a regex, so a Cookie header
could make it die or backtrack catastrophically
- CVE-2026-120632: a crafted multipart/related Content-Type header
caused cubic regex backtracking (~15s of CPU for an 8KB header, no
body needed)
- CVE-2026-120650: request size, param and upload limits were missing
or unenforced: $POST_MAX defaulted to no limit, and was not enforced
at all for multipart bodies without a CONTENT_LENGTH (chunked
encoding), or for the boundary line of a multipart body without a
boundary=; PUTDATA/POSTDATA/PATCHDATA bodies were read into memory
in one go; and there was no limit on the number of params or
uploads in a request (a 40MB form body took 9s and 1.5GB of memory
to parse) - see the new $CGI::MAX_PARAMS and $CGI::MAX_UPLOADS
- CVE-2026-120651: an infinite loop reading a short PUT/POST/PATCH
body when $DISABLE_UPLOADS was set
- CVE-2026-120645: scrolling_list used submitted values as a regex
for optgroups
- CVE-2026-120646: uploadInfo() dereferenced plain strings as symbolic
references, so died when given some, e.g. "0"
- header injection / response splitting:
- CVE-2026-120639: with autoEscape off, header() decoded HTML entities
in extra header values after checking them for newlines, so
became CRLF; and multipart_start() and
CGI::Push::do_push did no newline checks
- CVE-2026-120644: CGI::Cookie path/domain/expires were not checked,
so ";" injected other cookie attributes
- CVE-2026-120647: the header() -attachment filename did not escape
quotes
- open redirects, and URLs/forms pointing at other hosts:
- CVE-2026-120633: url(), self_url(), virtual_host(), virtual_port()
trusted the client supplied X-Forwarded-Host header, and an
unvalidated Host, affecting the default redirect() location,
start_html(-base=>1) and default start_form() actions
- CVE-2026-120638: redirect() HTML decoded its URL after the
application had checked it, e.g. "//evil.example/" became
"//evil.example/"
- CVE-2026-120636: URLs built from the client supplied REQUEST_URI
could be protocol relative (//evil.example), absolute-form
(http://evil.example/) or have backslashes, and url(-relative=>1)
could return e.g. javascript:alert(1)
- cross site scripting:
- CVE-2026-120643: url()/self_url() could contain a raw single quote
(URI->canonical decodes %27)
- CVE-2026-120648: comment() text could end the HTML comment
- information disclosure:
- CVE-2026-120634: CGI::Carp warnings buffered for warningsToBrowser
were not reset between requests in persistent environments, so one
user's warnings could be shown to another
- CVE-2026-120635: multipart parsing differentials (fields smuggled past
a filtering proxy or WAF that parses per the RFCs):
- the boundary was matched anywhere, not only at the start of a line
- the boundary was used without its "--" for some User-Agents
- Content-Disposition name/filename were found inside other
parameters' quoted values
- boundaries over the RFC 2046 limit corrupted and merged parts
- other:
- CVE-2026-120641: client supplied upload filenames could contain a
path, allowing path traversal in applications that use them to save
the file
- CVE-2026-120640: clients could set POSTDATA/PUTDATA/PATCHDATA/
XForms:Model through the query string or a form field,
indistinguishable from the real body (e.g. a cross site HTML form
posting to a JSON endpoint)
- CVE-2026-120642: under taint mode the upload filename, uploadInfo()
values, path_info, Accept(), and some cookie and url_param values
were untainted
- CVE-2026-120637: an unrecognised REQUEST_METHOD (e.g. OPTIONS) made
the process' own command line arguments the request params
[ BREAKING CHANGES ]
- X-Forwarded-Host is no longer used by url()/self_url()/virtual_host()
/virtual_port(), and Host is only used if it is a valid host[:port].
behind a reverse proxy pass the right Host / SERVER_NAME, or set
$CGI::TRUST_X_FORWARDED_HOST = 1
- $CGI::POST_MAX now defaults to 128MB, set it to -1 for no limit
- $CGI::MAX_PARAMS (10,000) and $CGI::MAX_UPLOADS (1,000) are new
limits, set them to -1 for no limit. requests exceeding any of the
limits get a "413 Request entity too large" cgi_error
- upload filenames (param('upload'), the upload filehandle, and the
upload_hook) have any directory part and control characters removed.
the raw value is in uploadInfo($fh)->{'Content-Disposition'}, or set
$CGI::SANITIZE_UPLOAD_FILENAMES = 0
- redirect() URLs and header() values are no longer HTML unescaped -
pass e.g. /x?a=1&b=2, not /x?a=1&b=2
- multipart_start() header names are now capitalised like header()'s
- url(-relative=>1) prefixes a result that looks like it has a scheme
with ./, and URLs built from REQUEST_URI are reduced to a path on
this host (request_uri() still returns the literal value)
- url()/self_url() percent encode single quotes
- CGI::Cookie dies if path, expires or domain contain ";" or control
characters, or domain isn't a valid host name
- header() -attachment backslash escapes " and \ in the filename
- comment() inserts a space into any "--" in its text
- client sent params named POSTDATA, PUTDATA, PATCHDATA or XForms:Model
are ignored (an application's own initializer can still set them)
- under taint mode more request data is tainted, as listed above, so
must be untainted before use in e.g. open() or system()
- malformed multipart bodies are rejected: boundaries over 200
characters, a body supplied boundary not starting with --, or a
boundary line over 1KB. multipart/related requires the media type to
be exactly multipart/related (its parameters may now be in any order)
- offline (command line) debugging mode is only used when there is no
REQUEST_METHOD and no CGI server, FastCGI or mod_perl
- PUTDATA/POSTDATA/PATCHDATA upload_hook callbacks are now called per
4K chunk, as they already were for multipart uploads
- the IE 3.01 for Mac / DreamPassport multipart special case is removed
[ FIX ]
- chunked (no CONTENT_LENGTH) multipart requests without a boundary=
always failed, and the boundary line read now works under mod_perl
- read_postdata_putdata ignored SPIN_LOOP_MAX, dying on the first zero
length read
- a second CGI->new in the same request lost cgi_error, and shared the
first object's param arrays
- optgroup() ignored the documented -novals option
- import_names() wiped nested packages when clearing the namespace
- an upload whose filename was "0" lost its name
- an empty extra header() value came out as a lone "
[ META ]
- all modules are now version 5.00, including CGI::Cookie (was 4.59)
[ TESTING ]
- tests for all of the above
To generate a diff of this commit:
cvs rdiff -u -r1.124 -r1.124.2.1 pkgsrc/www/p5-CGI/Makefile
cvs rdiff -u -r1.74 -r1.74.4.1 pkgsrc/www/p5-CGI/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: pkgsrc/www/p5-CGI/Makefile
diff -u pkgsrc/www/p5-CGI/Makefile:1.124 pkgsrc/www/p5-CGI/Makefile:1.124.2.1
--- pkgsrc/www/p5-CGI/Makefile:1.124 Thu Jul 16 19:05:44 2026
+++ pkgsrc/www/p5-CGI/Makefile Wed Nov 11 13:19:32 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.124 2026/07/16 19:05:44 wiz Exp $
+# $NetBSD: Makefile,v 1.124.2.1 2026/11/11 13:19:32 maya Exp $
-DISTNAME= CGI-4.72
+DISTNAME= CGI-5.02
PKGNAME= p5-${DISTNAME}
-PKGREVISION= 1
CATEGORIES= www perl5
MASTER_SITES+= ${MASTER_SITE_PERL_CPAN:=../..//authors/id/L/LE/LEEJO/}
Index: pkgsrc/www/p5-CGI/distinfo
diff -u pkgsrc/www/p5-CGI/distinfo:1.74 pkgsrc/www/p5-CGI/distinfo:1.74.4.1
--- pkgsrc/www/p5-CGI/distinfo:1.74 Sun May 10 06:20:32 2026
+++ pkgsrc/www/p5-CGI/distinfo Wed Nov 11 13:19:32 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.74 2026/05/10 06:20:32 wiz Exp $
+$NetBSD: distinfo,v 1.74.4.1 2026/11/11 13:19:32 maya Exp $
-BLAKE2s (CGI-4.72.tar.gz) = f5897260ea9e88c51cb4d5bd09f5979c38c8019ec624875e759a122a84f12851
-SHA512 (CGI-4.72.tar.gz) = ec7f9d3707e6fba766b147625df5c6bda325e9d9d92e677d20c550a52fba919e249ad1242277521efa75985d94685ed60979b591b48b1f02b1846ffe2db71738
-Size (CGI-4.72.tar.gz) = 208136 bytes
+BLAKE2s (CGI-5.02.tar.gz) = e9101409aa04868a778cd10e1caff64c932dcf6516e4593605b9341850efe81b
+SHA512 (CGI-5.02.tar.gz) = 7eaa9eb63b7ce1a2095189240a62a18c43855d217adcd00985a16f0ae05ed726c1949083e3544e084daf38694c342952900c38f16a4f45c1e9cc6630182850d7
+Size (CGI-5.02.tar.gz) = 240753 bytes
Home |
Main Index |
Thread Index |
Old Index