{"id":"MGASA-2018-0428","summary":"Updated perl-Dancer2 packages fix security vulnerabilities","details":"Dancer2 0.206000 addresses several potential security issues. There is a\npotential RCE with regards to Storable. Dancer2 adds session ID validation to\nthe session engine so that session backends based on Storable can reject\nmalformed session IDs that may lead to exploitation of the RCE. Parsing\nrequests now uses HTTP::Entity::Parser which reduces the amount of code needed\nand does not require re-parsing the request body.\n\nThe perl-Dancer2 package has been updated to version 0.206.0 to fix this issue.\n\nAlso, the perl-HTTP-XSCookies, perl-WWW-Form-UrlEncoded,\nperl-HTTP-MultiPartParser, and perl-HTTP-Entity-Parser dependencies have been\nadded and the perl-Type-Tiny, perl-HTTP-Headers-Fast, perl-JSON-MaybeXS,\nperl-Cookie-Baker, and perl-Plack dependencies have been updated for the new\nperl-Dancer2 version.\n","modified":"2026-04-16T04:26:41.300688Z","published":"2018-11-03T11:55:18Z","references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2018-0428.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=23127"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IQXVVVJM54QO6NGMMJJH56545OVCFQA4/"}],"affected":[{"package":{"name":"perl-Dancer2","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-Dancer2?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.206.0-1.1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-Cookie-Baker","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-Cookie-Baker?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.100.0-1.2.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-HTTP-Entity-Parser","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-HTTP-Entity-Parser?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.210.0-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-HTTP-Headers-Fast","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-HTTP-Headers-Fast?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.210.0-1.1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-HTTP-MultiPartParser","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-HTTP-MultiPartParser?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.0-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-HTTP-XSCookies","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-HTTP-XSCookies?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.21-1.1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-JSON-MaybeXS","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-JSON-MaybeXS?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-Plack","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-Plack?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.700-1.1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-Type-Tiny","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-Type-Tiny?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-1.1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}},{"package":{"name":"perl-WWW-Form-UrlEncoded","ecosystem":"Mageia:6","purl":"pkg:rpm/mageia/perl-WWW-Form-UrlEncoded?arch=source&distro=mageia-6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.250.0-1.mga6"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2018-0428.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}