Re: Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part)

[Jan Lieskovsky <jlieskov () redhat com>]

Hi Mark, Andy,

Ludwig Nussel wrote:
> Mark Stosberg wrote:
> > Yes, it is. However, later testing found that the issue wasn't
> > completely fixed in 3.50. A new patch has been developed, and is
> > currently pending review and acceptance by the primary CGI.pm author,
> > Lincoln Stein. (Now CC'ed).
>
> Any update on this? What are the remaining issues?

  Are there some patches to come yet wrt to Perl's CPAN CGI-Simple module
and those two CVE ids yet?

I can see latest CGi-Simple-v113 released on Monday, 27-th December 2010:
[1] http://search.cpan.org/dist/CGI-Simple/

Does it contain fixes for both CVE issues (so it is possible to rebase to new
version) or anything else to be done in this part of the world yet?

Is the fix, we were waiting for on the CGI-Simple side:
[2] https://github.com/AndyA/CGI--Simple/commit/5a861280ef524661105e132536ff7d1a9084941f

or yet another one?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> cu
> Ludwig