Package: drraw Version: 2.2b2-4 Severity: normal Tags: patch Hello,
I get a lot of log lines in my /var/log/apache2/error.log file: [Fri May 01 09:01:08.407652 2015] [cgi:error] [pid 29697] [client a.b.c.d:64395] AH01215: [Fri May 1 09:01:08 2015] drraw.cgi: CGI::param called in list context from package main line 1455, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436., referer: https://xxx.yyy.fr/ it looks like the solution is available at https://metacpan.org/pod/CGI#Fetching-the-value-or-values-of-a-single-named-parameter My proposed patch is to just ignore the warning. A better patch (untested) would be to solve the problem using "scalar param('foo')" instead of "param('foo')" as proposed in the URL above. --- drraw.cgi 2015-05-25 11:33:41.000000000 +0200 +++ /usr/lib/cgi-bin/drraw/drraw.cgi 2015-05-25 11:43:27.904119485 +0200 @@ -55,6 +55,8 @@ # in tainted mode. $ENV{'PATH'} = '/bin:/usr/bin'; +$CGI::LIST_CONTEXT_WARN = 0; + ############################################################################### ## STOP STOP STOP STOP STOP STOP STOP STOP STOP STOP STOP STOP STOP STOP ## ## ## -- System Information: Debian Release: 8.0 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.16.0-4-686-pae (SMP w/2 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages drraw depends on: ii librrds-perl 1.4.8-1.2 Versions of packages drraw recommends: ii apache2 [httpd] 2.4.10-10 ii apache2-mpm-prefork [httpd] 2.4.10-10 ii librcs-perl 1.05-4 Versions of packages drraw suggests: pn collectd <none> -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
