CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade perl-parentUpgrade perl-Pod-EscapesUpgrade perl-IO-Compress-Bzip2Upgrade perl-CPANUpgrade perl-CPANPLUSUpgrade perl-Compress-Raw-ZlibUpgrade perl-ExtUtils-MakeMakerUpgrade perl-Log-MessageUpgrade perl-Archive-ExtractUpgrade perl-Log-Message-SimpleUpgrade perl-Object-AccessorUpgrade perl-Archive-TarUpgrade perl-Digest-SHAUpgrade perl-ExtUtils-EmbedUpgrade perl-Compress-ZlibUpgrade perl-Package-ConstantsUpgrade perl-Term-UIUpgrade perl-CGIUpgrade perl-Time-HiResUpgrade perl-coreUpgrade perl-Params-CheckUpgrade perl-IO-Compress-BaseUpgrade perl-Time-PieceUpgrade perl-File-FetchUpgrade perl-Parse-CPAN-MetaUpgrade perl-ExtUtils-CBuilderUpgrade perl-IO-Compress-ZlibUpgrade perl-Test-SimpleUpgrade perl-Pod-SimpleUpgrade perl-libsUpgrade perlUpgrade perl-Compress-Raw-Bzip2Upgrade perl-Test-HarnessUpgrade perl-Module-PluggableUpgrade perl-develUpgrade perl-versionUpgrade perl-suidperlUpgrade perl-Module-Load-ConditionalUpgrade perl-ExtUtils-ParseXSUpgrade perl-Module-CoreListUpgrade perl-IPC-CmdUpgrade perl-Module-LoadedUpgrade perl-Locale-Maketext-SimpleUpgrade perl-Module-LoadUpgrade perl-IO-ZlibUpgrade perl-Module-Build | Dec 1, 2016 | Nov 21, 2012 |
| Debian | — | Upgrade libcgi-pm-perlUpgrade perl | Jul 30, 2024 | Nov 21, 2012 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 15, 2015 |
| Ibm Aix | — | Apply the fix or workaround for perl_advisory3 | Nov 30, 2017 | Nov 21, 2012 |
| Oracle Solaris | — | Upgrade consolidation/osnet/osnet-incorporation to version 0.5.11-0.175.2.0.0.42.2 on Solaris 11.2Upgrade runtime/perl-584 to version 5.8.4-0.175.1.7.0.5.2 on Solaris 11.1Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4Upgrade runtime/perl-512 to version 5.12.5-0.175.1.7.0.2.0 on Solaris 11.1Upgrade runtime/perl-584/extra to version 5.8.4-0.175.1.7.0.5.2 on Solaris 11.1 | May 29, 2017 | Nov 21, 2012 |
| Oracle_linux | — | Upgrade perl-Locale-Maketext-SimpleUpgrade perl-Module-LoadUpgrade perl-Params-CheckUpgrade perl-CPANPLUSUpgrade perl-ExtUtils-CBuilderUpgrade perl-Module-LoadedUpgrade perl-IPC-CmdUpgrade perl-Object-AccessorUpgrade perl-Compress-ZlibUpgrade perl-Module-PluggableUpgrade perl-File-FetchUpgrade perl-CPANUpgrade perl-Module-Load-ConditionalUpgrade perl-IO-Compress-ZlibUpgrade perl-Log-Message-SimpleUpgrade perl-ExtUtils-EmbedUpgrade perl-IO-Compress-BaseUpgrade perl-Log-MessageUpgrade perl-ExtUtils-MakeMakerUpgrade perl-Time-PieceUpgrade perl-coreUpgrade perl-ExtUtils-ParseXSUpgrade perl-Archive-ExtractUpgrade perl-Module-CoreListUpgrade perl-IO-Compress-Bzip2Upgrade perl-IO-ZlibUpgrade perl-Test-HarnessUpgrade perl-Pod-EscapesUpgrade perl-Compress-Raw-Bzip2Upgrade perl-Term-UIUpgrade perl-suidperlUpgrade perl-Archive-TarUpgrade perl-Package-ConstantsUpgrade perl-Pod-SimpleUpgrade perl-versionUpgrade perl-develUpgrade perl-Time-HiResUpgrade perlUpgrade perl-Digest-SHAUpgrade perl-CGIUpgrade perl-Compress-Raw-ZlibUpgrade perl-libsUpgrade perl-parentUpgrade perl-Module-BuildUpgrade perl-Parse-CPAN-MetaUpgrade perl-Test-Simple | Oct 16, 2024 | Nov 21, 2012 |
| Suse | — | Upgrade perl-baseUpgrade perlUpgrade perl-base-32bitUpgrade perl-x86Upgrade perl-Test-SimpleUpgrade perl-docUpgrade perl-Module-BuildUpgrade perl-32bit | Feb 17, 2015 | Jul 9, 2013 |
| Ubuntu | — | Upgrade perl | Nov 8, 2024 | Nov 21, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub