From ${URL} : A remote command-injection flaw was reported in HTTP::Body::Multipart versions 1.08 and later[1]. An attacker able to upload files to a service that uses HTTP::Body::Multipart could execute commands on the server. [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=721634 @maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.
CVE-2013-4407 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-4407): HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.
Patch from RH / Debian added in our 1.190.0 version bump Vulnerable version removed Perl out.