Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.

Apply fix for CVE-2014-5269: Plack::App::File would previously strip trailing slashes off provided paths. This could under specific circumstances lead to the unintended delivery of files. For details see https://github.com/plack/Plack/pull/446 .

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This perl-Plack update fixes the following security issue :

  - bnc#892328: trailing slashes removed leading to source     code disclosure (CVE-2014-5269)

Updated perl-Plack package fixes security vulnerability :

Plack::App::File would previously strip trailing slashes off provided paths. This in combination with the common pattern of serving files with Plack::Middleware::Static could allow an attacker to bypass a whitelist of generated files (CVE-2014-5269).

----------------------------------------------------------------------
---------- ChangeLog :

  - Fri Aug 8 2014 Ralf Corsepius <corsepiu at     fedoraproject.org> - 1.0031-1

    - Upstream update.

    - Thu Jan 16 2014 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0030-3

    - Move misplaced %exclude-line from base-package to
      *-Test.

    - Wed Jan 15 2014 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0030-2

    - Split out perl-Plack-Test to avoid dependency on       Test::More (RHBZ #1052859).

    - Mon Dec 30 2013 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0030-1

    - Upstream update.

    - Wed Sep 18 2013 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0029-1

    - Upstream update.

    - Update BRs.

    - Modernize spec.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

----------------------------------------------------------------------
---------- ChangeLog :

  - Fri Aug 8 2014 Ralf Corsepius <corsepiu at     fedoraproject.org> - 1.0031-1

    - Upstream update.

    - Thu Jan 16 2014 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0030-3

    - Move misplaced %exclude-line from base-package to
      *-Test.

    - Wed Jan 15 2014 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0030-2

    - Split out perl-Plack-Test to avoid dependency on       Test::More (RHBZ #1052859).

    - Mon Dec 30 2013 Ralf Corsepius <corsepiu at       fedoraproject.org> - 1.0030-1

    - Upstream update.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82206	Debian DLA-61-1 : libplack-perl security update	Nessus	Debian Local Security Checks	medium
80048	openSUSE Security Update : perl-Plack (openSUSE-SU-2014:1639-1)	Nessus	SuSE Local Security Checks	medium
79631	Mandriva Linux Security Advisory : perl-Plack (MDVSA-2014:235)	Nessus	Mandriva Local Security Checks	medium
77426	Fedora 19 : perl-Plack-1.0031-1.fc19 (2014-9544)	Nessus	Fedora Local Security Checks	medium
77425	Fedora 20 : perl-Plack-1.0031-1.fc20 (2014-9542)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-5269

high

Tenable Plugins

medium

medium

medium

medium

medium