mod_perl security update

2007-06-1414:57:11

CentOS Project

lists.centos.org

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.006 Low

EPSS

Percentile

77.8%

JSON

CentOS Errata and Security Advisory CESA-2007:0395

Mod_perl incorporates a Perl interpreter into the Apache web server,
so that the Apache web server can directly execute Perl code.

An issue was found in the “namespace_from_uri” method of the
ModPerl::RegistryCooker class. If a server implemented a mod_perl registry
module using this method, a remote attacker requesting a carefully crafted
URI can cause resource consumption, which could lead to a denial of service
(CVE-2007-1349).

Users of mod_perl should update to these erratum packages which contain a
backported fix to correct this issue.

Affected packages:
mod_perl
mod_perl-devel

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0395

OSVersionArchitecturePackageVersionFilename
CentOS3i386mod_perl< 1.99_09-12.entmod_perl-1.99_09-12.ent.i386.rpm
CentOS3i386mod_perl-devel< 1.99_09-12.entmod_perl-devel-1.99_09-12.ent.i386.rpm
CentOS3x86_64mod_perl< 1.99_09-12.entmod_perl-1.99_09-12.ent.x86_64.rpm
CentOS3x86_64mod_perl-devel< 1.99_09-12.entmod_perl-devel-1.99_09-12.ent.x86_64.rpm
CentOS5x86_64mod_perl< 2.0.2-6.3.el5mod_perl-2.0.2-6.3.el5.x86_64.rpm
CentOS5i386mod_perl-devel< 2.0.2-6.3.el5mod_perl-devel-2.0.2-6.3.el5.i386.rpm
CentOS5x86_64mod_perl-devel< 2.0.2-6.3.el5mod_perl-devel-2.0.2-6.3.el5.x86_64.rpm
CentOS5i386mod_perl< 2.0.2-6.3.el5mod_perl-2.0.2-6.3.el5.i386.rpm
CentOS5i386mod_perl-devel< 2.0.2-6.3.el5mod_perl-devel-2.0.2-6.3.el5.i386.rpm
CentOS3ia64mod_perl< 1.99_09-12.entmod_perl-1.99_09-12.ent.ia64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	mod_perl	< 1.99_09-12.ent	mod_perl-1.99_09-12.ent.i386.rpm
CentOS	3	i386	mod_perl-devel	< 1.99_09-12.ent	mod_perl-devel-1.99_09-12.ent.i386.rpm
CentOS	3	x86_64	mod_perl	< 1.99_09-12.ent	mod_perl-1.99_09-12.ent.x86_64.rpm
CentOS	3	x86_64	mod_perl-devel	< 1.99_09-12.ent	mod_perl-devel-1.99_09-12.ent.x86_64.rpm
CentOS	5	x86_64	mod_perl	< 2.0.2-6.3.el5	mod_perl-2.0.2-6.3.el5.x86_64.rpm
CentOS	5	i386	mod_perl-devel	< 2.0.2-6.3.el5	mod_perl-devel-2.0.2-6.3.el5.i386.rpm
CentOS	5	x86_64	mod_perl-devel	< 2.0.2-6.3.el5	mod_perl-devel-2.0.2-6.3.el5.x86_64.rpm
CentOS	5	i386	mod_perl	< 2.0.2-6.3.el5	mod_perl-2.0.2-6.3.el5.i386.rpm
CentOS	5	i386	mod_perl-devel	< 2.0.2-6.3.el5	mod_perl-devel-2.0.2-6.3.el5.i386.rpm
CentOS	3	ia64	mod_perl	< 1.99_09-12.ent	mod_perl-1.99_09-12.ent.ia64.rpm