Bug 908905 (CVE-2022-31081)

Summary:	<dev-perl/HTTP-Daemon-6.160.0: Incorrect handling of multiple Content-Length headers
Product:	Gentoo Security	Reporter:	Sam James <sam>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	IN_PROGRESS ---
Severity:	normal	CC:	perl
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	?? [stable?]
Package list:		Runtime testing required:	---

Description Sam James archtester

2023-06-21 03:49:53 UTC

From 6.15 release notes (https://metacpan.org/dist/HTTP-Daemon/changes):
"""
6.15      2023-02-22 22:02:46Z
  - Fix CVE-2022-31081: Inconsistent Interpretation of HTTP Requests
    Correctly handle multiple Content-Length headers and its variants
    (Theo van Hoesel)
[...]
"""

Comment 1 Larry the Git Cow gentoo-dev

2023-06-21 04:11:19 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=760eb2e76b6f7e9923861936033a987f25287e73

commit 760eb2e76b6f7e9923861936033a987f25287e73
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-06-21 03:45:11 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-06-21 04:10:54 +0000

    dev-perl/HTTP-Daemon: add 6.160.0
    
    Bug: https://bugs.gentoo.org/908905
    Signed-off-by: Sam James <sam@gentoo.org>

 dev-perl/HTTP-Daemon/HTTP-Daemon-6.160.0.ebuild | 36 +++++++++++++++++++++++++
 dev-perl/HTTP-Daemon/Manifest                   |  1 +
 2 files changed, 37 insertions(+)