Security Advisories (1)
CVE-2013-4407 (2013-09-02)

HTTP::Body::Multipart in the HTTP-Body 1.08, 1.22, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.

Changes for version 1.08

  • Temp files now preserve the suffix of the uploaded file. This makes it possible to feed the file directly into a mime-type-determing module that may rely on this suffix as part of its heuristic. (Dave Rolsky)
  • Fix for RT#54443 Xforms buffering incorrectly (Simon Elliott)
  • Move to Dist::Zilla

Modules

HTTP Body Parser
HTTP Body Multipart Parser
HTTP Body OctetStream Parser
HTTP Body UrlEncoded Parser
HTTP Body XForms Parser
HTTP Body XForms multipart/related submission Parser