REDHAT-BUG-736604: Medium severity fastcgi vulnerability
It was found that the perl Fast CGI module did not properly clean up certain environment variables, related to a particular HTTP request, between subsequent incoming requests. Any environment variable set in the first pass through the code by processing the first request, that wasn't set in some subsequent request, has been added to the hash containing environment variables for that subsequent request. A remote attacker could use this flaw to bypass the authentication process and obtain access to resources, which would be otherwise protected by authentication.
References: [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=607479
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-736604?
The severity of REDHAT-BUG-736604 is categorized as moderate due to the improper handling of environment variables that can lead to potential data exposure.
How do I fix REDHAT-BUG-736604?
To fix REDHAT-BUG-736604, ensure to update to the patched version of the Perl Fast CGI module that addresses the environment variable cleanup issue.
What are the potential risks associated with REDHAT-BUG-736604?
The potential risks associated with REDHAT-BUG-736604 include unauthorized access to sensitive data through improperly handled environment variables.
Which versions of Perl Fast CGI are affected by REDHAT-BUG-736604?
REDHAT-BUG-736604 affects certain versions of the Perl Fast CGI module prior to the implementation of the fixes.
Is there a workaround for REDHAT-BUG-736604?
A potential workaround for REDHAT-BUG-736604 is to manually sanitize environment variables between requests until an update can be applied.