Vulnerability feed

Executive summary

HTTP::Headers::ActionPack for Perl, before version 0.10, can be forced to use excessive CPU by a crafted Accept-Language header. The advisory says the fix changes language matching so header values are compared as plain text instead of regular expressions. The advisory does not state a severity rating, and the fix is in the code change shown.

Technical summary

The flaw is classed as CPU exhaustion caused by treating Accept-Language range values as unescaped regular expressions, which is a regular expression denial-of-service issue. The advisory states that versions before 0.10 are affected and that the attacker can submit crafted Accept-Language headers, with no authentication described in the text. The patch replaces the regex match in _language_match with a case-insensitive exact, wildcard, or prefix comparison using substr, and adds a timing test. The fixed version is stated as 0.10 in the affected-version line, and the Changes entry is under an unreleased heading, so the released version number is not otherwise stated. No workaround is stated, no CVSS score is stated, and no detection guidance or exploitation status is stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/robrwo/perl-HTTP-Headers-Act…2750e0f0f4bec9.patch

Score

No CVSS score published.

Affects

Robert RothenbergRobert Rothenberg HTTP::Headers::ActionPack

Executive summary

Robots::Validate, a Perl module that checks whether a web client claiming to be a search robot is genuine, has a flaw in which one client's request can affect how a later client's request is judged. The advisory says this can let clients be reported as imposter robots, and the fix is in version 0.4.10. The advisory does not state a severity score, and the vendor's recommendation is to update to 0.4.10 or later.

Technical summary

The flaw is a state-carryover issue in the pure-Perl pattern matcher used for User-Agent matching, where feed() continues from the previous call's position, so the tail of one User-Agent and the head of the next can be matched together. The advisory describes this as allowing a client to leave the matcher one character short of a robot name for the next client to complete. Affected versions are stated as 0.4.3 before 0.4.10, and the fix is in 0.4.10, which resets the machine state to the root on each validation. The advisory does not state a CVSS score, a workaround, exploitation in the wild, or specific detection guidance beyond the added regression test.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/robrwo/Robots-Validate/commi…3d5006ef384402.patch

Score

No CVSS score published.

Affects

Robert RothenbergAlgorithm::AhoCorasick::SearchMachineRobert Rothenberg Robots::ValidateAlgorithm::AhoCorasick::SearchMachine