CVE-2022-31081
Summary
| CVE | CVE-2022-31081 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-06-27 21:15:00 UTC |
|---|
| Updated | 2023-11-07 03:47:00 UTC |
|---|
| Description | HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Operating System |
Debian |
Debian Linux |
10.0 |
All |
All |
All |
| Application |
Http |
|
daemon_project |
http\ |
\ |
daemon |
References
| Reference | Source | Link | Tags |
|---|
| Fix Content-Length ', '-separated string issues · libwww-perl/HTTP-Daemon@e84475d · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 38 Update: perl-HTTP-Daemon-6.16-1.fc38 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| CWE -
CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (4.7) |
MISC |
cwe.mitre.org |
|
| Include reason in response body content · libwww-perl/HTTP-Daemon@8dc5269 · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 36 Update: perl-HTTP-Daemon-6.16-1.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] [DLA 3127-1] libhttp-daemon-perl security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 36 Update: perl-HTTP-Daemon-6.16-1.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in HTTP::Daemon · Advisory · libwww-perl/HTTP-Daemon · GitHub |
CONFIRM |
github.com |
|
| RFC 7230 - Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing |
MISC |
datatracker.ietf.org |
|
| [SECURITY] Fedora 38 Update: perl-HTTP-Daemon-6.16-1.fc38 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 37 Update: perl-HTTP-Daemon-6.16-1.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 37 Update: perl-HTTP-Daemon-6.16-1.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| HTTP-Daemon-6.12 - A simple http server class - metacpan.org |
MISC |
metacpan.org |
|
| HTTP Desync Attacks: Request Smuggling Reborn | PortSwigger Research |
MISC |
portswigger.net |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 181036 Debian Security Update for libhttp-daemon-perl (CVE-2022-31081)
- 181103 Debian Security Update for libhttp-daemon-perl (DLA 3127-1)
- 198863 Ubuntu Security Notification for HTTP-Daemon Vulnerability (USN-5520-1)
- 283769 Fedora Security Update for perl (FEDORA-2023-424636c7cb)
- 283770 Fedora Security Update for perl (FEDORA-2023-c230cc08c4)
- 284272 Fedora Security Update for perl (FEDORA-2023-748e811334)
- 330137 IBM AIX Vulnerability in perl (perl_advisory6)
- 355620 Amazon Linux Security Advisory for perl-HTTP-Daemon : ALAS2023-2023-247
- 752498 SUSE Enterprise Linux Security Update for perl-HTTP-Daemon (SUSE-SU-2022:2874-1)
- 752499 SUSE Enterprise Linux Security Update for perl-HTTP-Daemon (SUSE-SU-2022:2872-1)
