Re: CVE request for CGI::Application information disclosure flaw

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> it would unexpectedly dump a complete set of web query data and server
> environment information as an error page

> https://rt.cpan.org/Public/Bug/Display.html?id=84403
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=739505
> https://github.com/markstos/CGI--Application/pull/15
> https://github.com/markstos/CGI--Application/commit/61d327646f01fe
> https://bugzilla.redhat.com/show_bug.cgi?id=1067180

> until 2008, if you overloaded setup() - which everyone does - you had
> NO start->dump_html default at all in run_mode!
>
> After the change, you ALWAYS have dump_html as a default run_mode
> unless you explicitly redefine it in your code.
>
> Behaviour of an otherwise unmodified application changed due to an
> update of Application.pm. Data that should not be shown AND was not
> shown when using versions before v4.19 was now on screen. Customers
> were not amused.

Use CVE-2013-7329.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTBYznAAoJEKllVAevmvms7eIH/2A2wmKR1/15a9WPmC2pgyFD
Ees3KWHHcKXGf/5gXy+ci2e0BPTH61R+k5sJqk3ljHfKGDjsy+4bdFvzoaroM/q5
NduEjXJHC/+RIsYoZ1ZdXUZbjwa7zDqeaqvcPjy6kQmeinYT4VYHkYioxvveCCZ6
KomoKkpSfFt01ddsPumw99CVB44yFuhBqfTjCilyJAFqHpMzqxq2JSMbcXwIB1v6
EBsUnFS0f6mG5iR1yNJbfpUCD5xoOtyty7GtIaGFAvB8jxZn3JZFQzGQ4rTZLh8J
Xs0IGtMEVA6jP3vdo8LTlQAzvrzgMkMPdbGn0ICSr0O2CW0U1unEMSeG4VugJUA=
=Ge6r
-----END PGP SIGNATURE-----