AmazonALAS-2011-005Medium: perl-FCGI
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
61.1%
Issue Overview:
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.
Affected Packages:
perl-FCGI
Issue Correction:
Run yum update perl-FCGI to update your system.
New Packages:
i686:
perl-FCGI-debuginfo-0.74-1.0.amzn1.i686
perl-FCGI-0.74-1.0.amzn1.i686
src:
perl-FCGI-0.74-1.0.amzn1.src
x86_64:
perl-FCGI-debuginfo-0.74-1.0.amzn1.x86_64
perl-FCGI-0.74-1.0.amzn1.x86_64
Additional References
Red Hat: CVE-2011-2766
Mitre: CVE-2011-2766
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Amazon Linux | 1 | i686 | perl-fcgi-debuginfo | < 0.74-1.0.amzn1 | perl-FCGI-debuginfo-0.74-1.0.amzn1.i686.rpm |
| Amazon Linux | 1 | i686 | perl-fcgi | < 0.74-1.0.amzn1 | perl-FCGI-0.74-1.0.amzn1.i686.rpm |
| Amazon Linux | 1 | x86_64 | perl-fcgi-debuginfo | < 0.74-1.0.amzn1 | perl-FCGI-debuginfo-0.74-1.0.amzn1.x86_64.rpm |
| Amazon Linux | 1 | x86_64 | perl-fcgi | < 0.74-1.0.amzn1 | perl-FCGI-0.74-1.0.amzn1.x86_64.rpm |
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.002 Low
EPSS
Percentile
61.1%