Security update for perl-HTTP-Daemon SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2874-1 Final 1 1 2022-08-23T08:33:43Z current 2022-08-23T08:33:43Z 2022-08-23T08:33:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for perl-HTTP-Daemon This update for perl-HTTP-Daemon fixes the following issues: - CVE-2022-31081: Fixed request smuggling in HTTP::Daemon (bsc#1201157). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Image SLES15-SP1-SAP-Azure-LI-BYOS-Production-2022-2874,Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production-2022-2874,Image SLES15-SP2-SAP-Azure-2022-2874,Image SLES15-SP2-SAP-Azure-LI-BYOS-Production-2022-2874,Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production-2022-2874,Image SLES15-SP2-SAP-BYOS-Azure-2022-2874,Image SLES15-SP2-SAP-BYOS-EC2-HVM-2022-2874,Image SLES15-SP2-SAP-BYOS-GCE-2022-2874,Image SLES15-SP2-SAP-EC2-HVM-2022-2874,Image SLES15-SP2-SAP-GCE-2022-2874,Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure-2022-2874,Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM-2022-2874,Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE-2022-2874,Image SLES15-SP3-SAP-Azure-LI-BYOS-Production-2022-2874,Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production-2022-2874,Image SLES15-SP3-SAP-BYOS-Azure-2022-2874,Image SLES15-SP3-SAP-BYOS-EC2-HVM-2022-2874,Image SLES15-SP3-SAP-BYOS-GCE-2022-2874,Image SLES15-SP4-Manager-Server-4-3-BYOS-2022-2874,Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure-2022-2874,Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2-2022-2874,Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE-2022-2874,Image SLES15-SP4-SAP-Azure-LI-BYOS-2022-2874,Image SLES15-SP4-SAP-Azure-LI-BYOS-Production-2022-2874,Image SLES15-SP4-SAP-Azure-VLI-BYOS-2022-2874,Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production-2022-2874,Image SLES15-SP4-SAP-BYOS-2022-2874,Image SLES15-SP4-SAP-BYOS-Azure-2022-2874,Image SLES15-SP4-SAP-BYOS-EC2-2022-2874,Image SLES15-SP4-SAP-BYOS-GCE-2022-2874,Image SLES15-SP4-SAP-Hardened-2022-2874,Image SLES15-SP4-SAP-Hardened-Azure-2022-2874,Image SLES15-SP4-SAP-Hardened-BYOS-2022-2874,Image SLES15-SP4-SAP-Hardened-BYOS-Azure-2022-2874,Image SLES15-SP4-SAP-Hardened-BYOS-EC2-2022-2874,Image SLES15-SP4-SAP-Hardened-BYOS-GCE-2022-2874,Image SLES15-SP4-SAP-Hardened-EC2-2022-2874,Image SLES15-SP4-SAP-Hardened-GCE-2022-2874,Image SLES15-SP5-SAP-Azure-LI-BYOS-2022-2874,Image SLES15-SP5-SAP-Azure-LI-BYOS-Production-2022-2874,Image SLES15-SP5-SAP-Azure-VLI-BYOS-2022-2874,Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production-2022-2874,Image SLES15-SP5-SAP-BYOS-Azure-2022-2874,Image SLES15-SP5-SAP-BYOS-EC2-2022-2874,Image SLES15-SP5-SAP-BYOS-GCE-2022-2874,Image SLES15-SP5-SAP-Hardened-Azure-2022-2874,Image SLES15-SP5-SAP-Hardened-BYOS-Azure-2022-2874,Image SLES15-SP5-SAP-Hardened-BYOS-EC2-2022-2874,Image SLES15-SP5-SAP-Hardened-BYOS-GCE-2022-2874,Image SLES15-SP5-SAP-Hardened-EC2-2022-2874,Image SLES15-SP5-SAP-Hardened-GCE-2022-2874,SUSE-2022-2874,SUSE-SLE-Module-Basesystem-15-SP3-2022-2874,SUSE-SLE-Module-Basesystem-15-SP4-2022-2874,openSUSE-SLE-15.3-2022-2874,openSUSE-SLE-15.4-2022-2874 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222874-1/ Link for SUSE-SU-2022:2874-1 https://lists.suse.com/pipermail/sle-security-updates/2022-August/011970.html E-Mail link for SUSE-SU-2022:2874-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1201157 SUSE Bug 1201157 https://www.suse.com/security/cve/CVE-2022-31081/ SUSE CVE CVE-2022-31081 page Image SLES15-SP1-SAP-Azure-LI-BYOS-Production Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-Azure Image SLES15-SP2-SAP-Azure-LI-BYOS-Production Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production Image SLES15-SP2-SAP-BYOS-Azure Image SLES15-SP2-SAP-BYOS-EC2-HVM Image SLES15-SP2-SAP-BYOS-GCE Image SLES15-SP2-SAP-EC2-HVM Image SLES15-SP2-SAP-GCE Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE Image SLES15-SP3-SAP-Azure-LI-BYOS-Production Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production Image SLES15-SP3-SAP-BYOS-Azure Image SLES15-SP3-SAP-BYOS-EC2-HVM Image SLES15-SP3-SAP-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-EC2 Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-EC2 Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-EC2 Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP5-SAP-Azure-LI-BYOS Image SLES15-SP5-SAP-Azure-LI-BYOS-Production Image SLES15-SP5-SAP-Azure-VLI-BYOS Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production Image SLES15-SP5-SAP-BYOS-Azure Image SLES15-SP5-SAP-BYOS-EC2 Image SLES15-SP5-SAP-BYOS-GCE Image SLES15-SP5-SAP-Hardened-Azure Image SLES15-SP5-SAP-Hardened-BYOS-Azure Image SLES15-SP5-SAP-Hardened-BYOS-EC2 Image SLES15-SP5-SAP-Hardened-BYOS-GCE Image SLES15-SP5-SAP-Hardened-EC2 Image SLES15-SP5-SAP-Hardened-GCE SUSE Linux Enterprise Module for Basesystem 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 openSUSE Leap 15.3 openSUSE Leap 15.4 perl-HTTP-Daemon-6.01-150000.3.5.1 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP1-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-BYOS-EC2-HVM perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-EC2-HVM perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP2-SAP-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-SAP-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-SAP-BYOS-EC2-HVM perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP3-SAP-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-BYOS-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP4-SAP-Hardened-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Azure-LI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-BYOS-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Hardened-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-Azure perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Hardened-BYOS-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Hardened-EC2 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of Image SLES15-SP5-SAP-Hardened-GCE perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP3 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of openSUSE Leap 15.3 perl-HTTP-Daemon-6.01-150000.3.5.1 as a component of openSUSE Leap 15.4 HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected. CVE-2022-31081 Image SLES15-SP1-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP1-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-BYOS-EC2-HVM:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-EC2-HVM:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP2-SAP-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-EC2-HVM:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-Manager-4-2-Server-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-SAP-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-SAP-BYOS-EC2-HVM:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP3-SAP-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-Manager-Server-4-3-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Azure-LI-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Azure-VLI-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-BYOS-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-BYOS-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP4-SAP-Hardened:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Azure-LI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Azure-LI-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS-Production:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Azure-VLI-BYOS:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-BYOS-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Hardened-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Hardened-BYOS-Azure:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Hardened-BYOS-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Hardened-BYOS-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Hardened-EC2:perl-HTTP-Daemon-6.01-150000.3.5.1 Image SLES15-SP5-SAP-Hardened-GCE:perl-HTTP-Daemon-6.01-150000.3.5.1 SUSE Linux Enterprise Module for Basesystem 15 SP3:perl-HTTP-Daemon-6.01-150000.3.5.1 SUSE Linux Enterprise Module for Basesystem 15 SP4:perl-HTTP-Daemon-6.01-150000.3.5.1 openSUSE Leap 15.3:perl-HTTP-Daemon-6.01-150000.3.5.1 openSUSE Leap 15.4:perl-HTTP-Daemon-6.01-150000.3.5.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222874-1/ https://www.suse.com/security/cve/CVE-2022-31081.html CVE-2022-31081 https://bugzilla.suse.com/1201157 SUSE Bug 1201157