Vulnerability feed

Executive summary

Robots::Validate, a Perl module that checks whether a web client claiming to be a search robot is genuine, has a flaw in which one client's request can affect how a later client's request is judged. The advisory says this can let clients be reported as imposter robots, and the fix is in version 0.4.10. The advisory does not state a severity score, and the vendor's recommendation is to update to 0.4.10 or later.

Technical summary

The flaw is a state-carryover issue in the pure-Perl pattern matcher used for User-Agent matching, where feed() continues from the previous call's position, so the tail of one User-Agent and the head of the next can be matched together. The advisory describes this as allowing a client to leave the matcher one character short of a robot name for the next client to complete. Affected versions are stated as 0.4.3 before 0.4.10, and the fix is in 0.4.10, which resets the machine state to the root on each validation. The advisory does not state a CVSS score, a workaround, exploitation in the wild, or specific detection guidance beyond the added regression test.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/robrwo/Robots-Validate/commi…3d5006ef384402.patch

Score

No CVSS score published.

Affects

Robert RothenbergAlgorithm::AhoCorasick::SearchMachineRobert Rothenberg Robots::ValidateAlgorithm::AhoCorasick::SearchMachine