Oval Definition:oval:com.redhat.rhsa:def:20110558
Revision Date:2011-05-19Version:648
Title:RHSA-2011:0558: perl security and bug fix update (Moderate)
Description:Perl is a high-level programming language commonly used for system administration utilities and web programming. The Perl CGI module provides resources for preparing and processing Common Gateway Interface (CGI) based HTTP requests and responses.

  • It was found that the Perl CGI module used a hard-coded value for the MIME boundary string in multipart/x-mixed-replace content. A remote attacker could possibly use this flaw to conduct an HTTP response splitting attack via a specially-crafted HTTP request. (CVE-2010-2761)

  • A CRLF injection flaw was found in the way the Perl CGI module processed a sequence of non-whitespace preceded by newline characters in the header. A remote attacker could use this flaw to conduct an HTTP response splitting attack via a specially-crafted sequence of characters provided to the CGI module. (CVE-2010-4410)

  • It was found that certain Perl string manipulation functions (such as uc() and lc()) failed to preserve the taint bit. A remote attacker could use this flaw to bypass the Perl taint mode protection mechanism in scripts that use the affected functions to process tainted input. (CVE-2011-1487)

    These packages upgrade the CGI module to version 3.51. Refer to the CGI module's Changes file, linked to in the References, for a full list of changes.

    This update also fixes the following bugs:

  • When using the "threads" module, an attempt to send a signal to a thread that did not have a signal handler specified caused the perl interpreter to terminate unexpectedly with a segmentation fault. With this update, the "threads" module has been updated to upstream version 1.82, which fixes this bug. As a result, sending a signal to a thread that does not have the signal handler specified no longer causes perl to crash. (BZ#626330)

    Prior to this update, the perl packages did not require the Digest::SHA module as a dependency. Consequent to this, when a user started the cpan command line interface and attempted to download a distribution from CPAN, they may have been presented with the following message:

    CPAN: checksum security checks disabled because Digest::SHA not installed. Please consider installing the Digest::SHA module.

  • This update corrects the spec file for the perl package to require the perl-Digest-SHA package as a dependency, and cpan no longer displays the above message. (BZ#640716)

  • When using the "threads" module, continual creation and destruction of threads could cause the Perl program to consume an increasing amount of memory. With this update, the underlying source code has been corrected to free the allocated memory when a thread is destroyed, and the continual creation and destruction of threads in Perl programs no longer leads to memory leaks. (BZ#640720)

  • Due to a packaging error, the perl packages did not include the "NDBM_File" module. This update corrects this error, and "NDBM_File" is now included as expected. (BZ#640729)

  • Prior to this update, the prove(1) manual page and the "prove --help" command listed "--fork" as a valid command line option. However, version 3.17 of the Test::Harness distribution removed the support for the fork-based parallel testing, and the prove utility thus no longer supports this option. This update corrects both the manual page and the output of the "prove --help" command, so that "--fork" is no longer included in the list of available command line options. (BZ#609492)

    Users of Perl, especially those of Perl threads, are advised to upgrade to these updated packages, which correct these issues.
  • Family:unixClass:patch
    Status:Reference(s):CVE-2010-2761
    CVE-2010-2761
    CVE-2010-4410
    CVE-2010-4410
    CVE-2011-1487
    CVE-2011-1487
    RHSA-2011:0558
    RHSA-2011:0558-01
    RHSA-2011:0558-01
    Platform(s):Red Hat Enterprise Linux 6
    Product(s):
    Definition Synopsis
  • Red Hat Enterprise Linux must be installed
  • OR Package Information
  • Red Hat Enterprise Linux 6 is installed
  • AND
  • perl is earlier than 4:5.10.1-119.el6
  • AND perl is signed with Red Hat redhatrelease2 key
  • perl-Archive-Extract is earlier than 1:0.38-119.el6
  • AND perl-Archive-Extract is signed with Red Hat redhatrelease2 key
  • perl-Archive-Tar is earlier than 0:1.58-119.el6
  • AND perl-Archive-Tar is signed with Red Hat redhatrelease2 key
  • perl-CGI is earlier than 0:3.51-119.el6
  • AND perl-CGI is signed with Red Hat redhatrelease2 key
  • perl-CPAN is earlier than 0:1.9402-119.el6
  • AND perl-CPAN is signed with Red Hat redhatrelease2 key
  • perl-CPANPLUS is earlier than 0:0.88-119.el6
  • AND perl-CPANPLUS is signed with Red Hat redhatrelease2 key
  • perl-Compress-Raw-Zlib is earlier than 0:2.023-119.el6
  • AND perl-Compress-Raw-Zlib is signed with Red Hat redhatrelease2 key
  • perl-Compress-Zlib is earlier than 0:2.020-119.el6
  • AND perl-Compress-Zlib is signed with Red Hat redhatrelease2 key
  • perl-Digest-SHA is earlier than 1:5.47-119.el6
  • AND perl-Digest-SHA is signed with Red Hat redhatrelease2 key
  • perl-ExtUtils-CBuilder is earlier than 1:0.27-119.el6
  • AND perl-ExtUtils-CBuilder is signed with Red Hat redhatrelease2 key
  • perl-ExtUtils-Embed is earlier than 0:1.28-119.el6
  • AND perl-ExtUtils-Embed is signed with Red Hat redhatrelease2 key
  • perl-ExtUtils-MakeMaker is earlier than 0:6.55-119.el6
  • AND perl-ExtUtils-MakeMaker is signed with Red Hat redhatrelease2 key
  • perl-ExtUtils-ParseXS is earlier than 1:2.2003.0-119.el6
  • AND perl-ExtUtils-ParseXS is signed with Red Hat redhatrelease2 key
  • perl-File-Fetch is earlier than 0:0.26-119.el6
  • AND perl-File-Fetch is signed with Red Hat redhatrelease2 key
  • perl-IO-Compress-Base is earlier than 0:2.020-119.el6
  • AND perl-IO-Compress-Base is signed with Red Hat redhatrelease2 key
  • perl-IO-Compress-Zlib is earlier than 0:2.020-119.el6
  • AND perl-IO-Compress-Zlib is signed with Red Hat redhatrelease2 key
  • perl-IO-Zlib is earlier than 1:1.09-119.el6
  • AND perl-IO-Zlib is signed with Red Hat redhatrelease2 key
  • perl-IPC-Cmd is earlier than 1:0.56-119.el6
  • AND perl-IPC-Cmd is signed with Red Hat redhatrelease2 key
  • perl-Locale-Maketext-Simple is earlier than 1:0.18-119.el6
  • AND perl-Locale-Maketext-Simple is signed with Red Hat redhatrelease2 key
  • perl-Log-Message is earlier than 1:0.02-119.el6
  • AND perl-Log-Message is signed with Red Hat redhatrelease2 key
  • perl-Log-Message-Simple is earlier than 0:0.04-119.el6
  • AND perl-Log-Message-Simple is signed with Red Hat redhatrelease2 key
  • perl-Module-Build is earlier than 1:0.3500-119.el6
  • AND perl-Module-Build is signed with Red Hat redhatrelease2 key
  • perl-Module-CoreList is earlier than 0:2.18-119.el6
  • AND perl-Module-CoreList is signed with Red Hat redhatrelease2 key
  • perl-Module-Load is earlier than 1:0.16-119.el6
  • AND perl-Module-Load is signed with Red Hat redhatrelease2 key
  • perl-Module-Load-Conditional is earlier than 0:0.30-119.el6
  • AND perl-Module-Load-Conditional is signed with Red Hat redhatrelease2 key
  • perl-Module-Loaded is earlier than 1:0.02-119.el6
  • AND perl-Module-Loaded is signed with Red Hat redhatrelease2 key
  • perl-Module-Pluggable is earlier than 1:3.90-119.el6
  • AND perl-Module-Pluggable is signed with Red Hat redhatrelease2 key
  • perl-Object-Accessor is earlier than 1:0.34-119.el6
  • AND perl-Object-Accessor is signed with Red Hat redhatrelease2 key
  • perl-Package-Constants is earlier than 1:0.02-119.el6
  • AND perl-Package-Constants is signed with Red Hat redhatrelease2 key
  • perl-Params-Check is earlier than 1:0.26-119.el6
  • AND perl-Params-Check is signed with Red Hat redhatrelease2 key
  • perl-Parse-CPAN-Meta is earlier than 1:1.40-119.el6
  • AND perl-Parse-CPAN-Meta is signed with Red Hat redhatrelease2 key
  • perl-Pod-Escapes is earlier than 1:1.04-119.el6
  • AND perl-Pod-Escapes is signed with Red Hat redhatrelease2 key
  • perl-Pod-Simple is earlier than 1:3.13-119.el6
  • AND perl-Pod-Simple is signed with Red Hat redhatrelease2 key
  • perl-Term-UI is earlier than 0:0.20-119.el6
  • AND perl-Term-UI is signed with Red Hat redhatrelease2 key
  • perl-Test-Harness is earlier than 0:3.17-119.el6
  • AND perl-Test-Harness is signed with Red Hat redhatrelease2 key
  • perl-Test-Simple is earlier than 0:0.92-119.el6
  • AND perl-Test-Simple is signed with Red Hat redhatrelease2 key
  • perl-Time-HiRes is earlier than 4:1.9721-119.el6
  • AND perl-Time-HiRes is signed with Red Hat redhatrelease2 key
  • perl-Time-Piece is earlier than 0:1.15-119.el6
  • AND perl-Time-Piece is signed with Red Hat redhatrelease2 key
  • perl-core is earlier than 0:5.10.1-119.el6
  • AND perl-core is signed with Red Hat redhatrelease2 key
  • perl-devel is earlier than 4:5.10.1-119.el6
  • AND perl-devel is signed with Red Hat redhatrelease2 key
  • perl-libs is earlier than 4:5.10.1-119.el6
  • AND perl-libs is signed with Red Hat redhatrelease2 key
  • perl-parent is earlier than 1:0.221-119.el6
  • AND perl-parent is signed with Red Hat redhatrelease2 key
  • perl-suidperl is earlier than 4:5.10.1-119.el6
  • AND perl-suidperl is signed with Red Hat redhatrelease2 key
  • perl-version is earlier than 3:0.77-119.el6
  • AND perl-version is signed with Red Hat redhatrelease2 key
  • BACK