Security update for perl-HTTP-Daemon SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2872-1 Final 1 1 2022-08-23T08:12:07Z current 2022-08-23T08:12:07Z 2022-08-23T08:12:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for perl-HTTP-Daemon This update for perl-HTTP-Daemon fixes the following issues: - CVE-2022-31081: Fixed request smuggling in HTTP::Daemon (bsc#1201157). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES12-SP4-SAP-Azure-LI-BYOS-Production-2022-2872,Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production-2022-2872,Image SLES12-SP5-Azure-SAP-BYOS-2022-2872,Image SLES12-SP5-Azure-SAP-On-Demand-2022-2872,Image SLES12-SP5-EC2-SAP-BYOS-2022-2872,Image SLES12-SP5-EC2-SAP-On-Demand-2022-2872,Image SLES12-SP5-GCE-SAP-BYOS-2022-2872,Image SLES12-SP5-GCE-SAP-On-Demand-2022-2872,Image SLES12-SP5-SAP-Azure-LI-BYOS-Production-2022-2872,Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production-2022-2872,SUSE-2022-2872,SUSE-SLE-SERVER-12-SP5-2022-2872 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222872-1/ Link for SUSE-SU-2022:2872-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011971.html E-Mail link for SUSE-SU-2022:2872-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201157 SUSE Bug 1201157 https://www.suse.com/security/cve/CVE-2022-31081/ SUSE CVE CVE-2022-31081 page Image SLES12-SP4-SAP-Azure-LI-BYOS-Production Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production Image SLES12-SP5-Azure-SAP-BYOS Image SLES12-SP5-Azure-SAP-On-Demand Image SLES12-SP5-EC2-SAP-BYOS Image SLES12-SP5-EC2-SAP-On-Demand Image SLES12-SP5-GCE-SAP-BYOS Image SLES12-SP5-GCE-SAP-On-Demand Image SLES12-SP5-SAP-Azure-LI-BYOS-Production Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 perl-HTTP-Daemon-6.01-9.5.1 perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP4-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-Azure-SAP-BYOS perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-Azure-SAP-On-Demand perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-EC2-SAP-BYOS perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-EC2-SAP-On-Demand perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-GCE-SAP-BYOS perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-GCE-SAP-On-Demand perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-9.5.1 as a component of Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-9.5.1 as a component of SUSE Linux Enterprise Server 12 SP5 perl-HTTP-Daemon-6.01-9.5.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected. CVE-2022-31081 Image SLES12-SP4-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP4-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-Azure-SAP-BYOS:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-Azure-SAP-On-Demand:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-EC2-SAP-BYOS:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-EC2-SAP-On-Demand:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-GCE-SAP-BYOS:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-GCE-SAP-On-Demand:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-9.5.1 Image SLES12-SP5-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-9.5.1 SUSE Linux Enterprise Server 12 SP5:perl-HTTP-Daemon-6.01-9.5.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:perl-HTTP-Daemon-6.01-9.5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222872-1/ https://www.suse.com/security/cve/CVE-2022-31081.html CVE-2022-31081 https://bugzilla.suse.com/1201157 SUSE Bug 1201157