Vulnerability Name:

CVE-2012-5526 (CCN-80098)

Assigned:2012-11-12
Published:2012-11-12
Updated:2017-08-29
Summary:CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
2.6 Low (REDHAT CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
2.2 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-16
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: IBM SECURITY ADVISORY
Security vulnerabilities in Perl for AIX

Source: CONFIRM
Type: UNKNOWN
http://cpansearch.perl.org/src/MARKSTOS/CGI.pm-3.63/Changes

Source: MITRE
Type: CNA
CVE-2012-5526

Source: CONFIRM
Type: UNKNOWN
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Source: CONFIRM
Type: UNKNOWN
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735

Source: CCN
Type: RHSA-2013-0685
Moderate: perl security update

Source: REDHAT
Type: UNKNOWN
RHSA-2013:0685

Source: CCN
Type: Search.cpan Web site
CGI.pm

Source: SECUNIA
Type: UNKNOWN
51457

Source: CCN
Type: SA55314
Oracle Solaris Perl Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
55314

Source: DEBIAN
Type: UNKNOWN
DSA-2586

Source: DEBIAN
Type: DSA-2586
perl -- several vulnerabilities

Source: DEBIAN
Type: DSA-2587
libcgi-pm-perl -- HTTP header injection

Source: MLIST
Type: UNKNOWN
[oss-security] 20121115 Re: CVE Request -- perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers

Source: CONFIRM
Type: UNKNOWN
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Source: BID
Type: UNKNOWN
56562

Source: CCN
Type: BID-56562
Perl CGI.pm 'Set-Cookie' and 'P3P' Headers HTTP Header Injection Vulnerability

Source: SECTRACK
Type: UNKNOWN
1027780

Source: UBUNTU
Type: UNKNOWN
USN-1643-1

Source: CCN
Type: Red Hat Bugzilla Bug 877015
CVE-2012-5526 perl-CGI: Newline injection due to improper CRLF escaping in Set-Cookie and P3P headers

Source: XF
Type: UNKNOWN
perl-cgipm-header-injection(80098)

Source: XF
Type: UNKNOWN
perl-cgipm-header-injection(80098)

Source: MISC
Type: UNKNOWN
https://github.com/markstos/CGI.pm/pull/23

Vulnerable Configuration:Configuration 1:
  • cpe:/a:andy_armstrong:cgi.pm:*:*:*:*:*:*:*:* (Version <= 3.62)

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:42420
    P
    		Security update for logrotate (Important)
    2022-07-25
    oval:org.opensuse.security:def:20125526
    V
    		CVE-2012-5526
    2022-05-20
    oval:org.opensuse.security:def:32233
    P
    		Security update for the Linux Kernel (Important)
    2021-12-06
    oval:org.opensuse.security:def:26162
    P
    		Security update for pcre (Moderate)
    2021-11-10
    oval:org.opensuse.security:def:31697
    P
    		Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:26156
    P
    		Security update for open-lldp (Moderate)
    2021-10-26
    oval:org.opensuse.security:def:26139
    P
    		Security update for libvirt (Moderate)
    2021-10-04
    oval:org.opensuse.security:def:32194
    P
    		Security update for xen (Important)
    2021-09-23
    oval:org.opensuse.security:def:32185
    P
    		Security update for ghostscript (Critical)
    2021-09-21
    oval:org.opensuse.security:def:32976
    P
    		Security update for cpio (Important)
    2021-08-14
    oval:org.opensuse.security:def:26099
    P
    		Security update for libsndfile (Critical)
    2021-08-05
    oval:org.opensuse.security:def:26098
    P
    		Security update for webkit2gtk3 (Important)
    2021-08-03
    oval:org.opensuse.security:def:32145
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:26086
    P
    		Security update for libsolv (Important)
    2021-06-28
    oval:org.opensuse.security:def:36537
    P
    		perl-base-32bit-5.10.0-64.72.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32937
    P
    		Security update for MozillaFirefox (Important)
    2021-06-08
    oval:org.opensuse.security:def:42672
    P
    		perl-32bit-5.10.0-64.72.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36265
    P
    		perl-32bit-5.10.0-64.72.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32089
    P
    		Security update for samba (Important)
    2021-05-04
    oval:org.opensuse.security:def:31743
    P
    		Security update for python (Moderate)
    2021-03-16
    oval:org.opensuse.security:def:31732
    P
    		Security update for krb5-appl (Important)
    2021-02-19
    oval:org.opensuse.security:def:31731
    P
    		Security update for java-1_7_1-ibm (Important)
    2021-02-18
    oval:org.opensuse.security:def:26192
    P
    		Security update for php72 (Important)
    2021-02-17
    oval:org.opensuse.security:def:32255
    P
    		Security update for the Linux Kernel (Important)
    2021-02-12
    oval:org.opensuse.security:def:26087
    P
    		Security update for sudo (Important)
    2021-01-26
    oval:org.opensuse.security:def:32098
    P
    		Security update for dovecot22 (Important)
    2021-01-04
    oval:org.opensuse.security:def:31565
    P
    		Security update for openssl (Important)
    2020-12-11
    oval:org.opensuse.security:def:36013
    P
    		perl-32bit-5.10.0-64.67.52 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:27228
    P
    		libxcrypt on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25562
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26428
    P
    		Security update for redis (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32507
    P
    		evolution-data-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25847
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:26804
    P
    		perl-HTML-Parser on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26241
    P
    		Security update for evolution (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25826
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27011
    P
    		perl-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26240
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32299
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32041
    P
    		Security update for krb5 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26546
    P
    		findutils on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26290
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32446
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:25638
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26716
    P
    		gvim on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33228
    P
    		perl-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31480
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27500
    P
    		libwebkit-1_0-2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25814
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:31846
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:26338
    P
    		Security update for Chromium (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31817
    P
    		Security update for atftp (Important)
    2020-12-01
    oval:org.opensuse.security:def:26493
    P
    		Security update for phpMyAdmin (Important)
    2020-12-01
    oval:org.opensuse.security:def:32341
    P
    		Security update for spice (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27263
    P
    		perl-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25563
    P
    		Security update for xrdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:26512
    P
    		Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32551
    P
    		libexiv2-4 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25904
    P
    		Security update for gegl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26818
    P
    		rsyslog on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26280
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25890
    P
    		Security update for php5 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26391
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:26590
    P
    		libmusicbrainz4 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26371
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:32485
    P
    		PolicyKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25766
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:26765
    P
    		librsvg on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31491
    P
    		Security update for Python
    2020-12-01
    oval:org.opensuse.security:def:27535
    P
    		perl-base-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25815
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31933
    P
    		Security update for glibc (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26976
    P
    		libtspi1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31949
    P
    		Security update for grub2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26532
    P
    		cron on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32397
    P
    		Security update for unzip (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25574
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26663
    P
    		PolicyKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33189
    P
    		libupsclient1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31479
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25988
    P
    		Security update for gd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26862
    P
    		apache2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31789
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26294
    P
    		Security update for bluez (Important)
    2020-12-01
    oval:org.opensuse.security:def:26018
    P
    		Security update for freerdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:26444
    P
    		Security update for mumble (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:26263
    P
    		SUSE-SU-2013:0441-1 -- Security update for Perl
    2014-09-08
    oval:org.mitre.oval:def:26050
    P
    		SUSE-SU-2013:0442-1 -- Security update for Perl
    2014-09-08
    oval:org.mitre.oval:def:18183
    P
    		USN-1643-1 -- perl vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:17940
    P
    		DSA-2587-1 libcgi-pm-perl - HTTP header injection
    2014-06-23
    oval:org.mitre.oval:def:19449
    P
    		DSA-2586-1 perl - several
    2014-06-23
    oval:org.mitre.oval:def:23712
    P
    		ELSA-2013:0685: perl security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:20994
    P
    		RHSA-2013:0685: perl security update (Moderate)
    2014-02-17
    oval:org.mitre.oval:def:21064
    V
    		Security vulnerabilities in Perl for AIX
    2014-02-10
    oval:com.redhat.rhsa:def:20130685
    P
    		RHSA-2013:0685: perl security update (Moderate)
    2013-03-26
    oval:com.ubuntu.precise:def:20125526000
    V
    		CVE-2012-5526 on Ubuntu 12.04 LTS (precise) - low.
    2012-11-21
    oval:com.ubuntu.trusty:def:20125526000
    V
    		CVE-2012-5526 on Ubuntu 14.04 LTS (trusty) - low.
    2012-11-21
    oval:com.ubuntu.xenial:def:201255260000000
    V
    		CVE-2012-5526 on Ubuntu 16.04 LTS (xenial) - low.
    2012-11-21
    oval:com.ubuntu.xenial:def:20125526000
    V
    		CVE-2012-5526 on Ubuntu 16.04 LTS (xenial) - low.
    2012-11-21
    BACK
    andy_armstrong cgi.pm *