Fedora alert FEDORA-2026-8982379b5c (perl-HTTP-Daemon)

From:
             
 
updates--- via package-announce <package-announce@lists.fedoraproject.org>
To:
             
 
package-announce@lists.fedoraproject.org
Subject:
             
 
[SECURITY] Fedora 44 Update: perl-HTTP-Daemon-6.17-1.fc44
Date:
             
 
Fri, 19 Jun 2026 01:01:48 +0000
Message-ID:
             
 
<20260619010148.E6F9F6E772@bastion01.rdu3.fedoraproject.org>
Archive-link:
             
 
Article
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2026-8982379b5c
2026-06-19 00:59:07.048604+00:00
--------------------------------------------------------------------------------

Name        : perl-HTTP-Daemon
Product     : Fedora 44
Version     : 6.17
Release     : 1.fc44
URL         : https://metacpan.org/release/HTTP-Daemon
Summary     : Simple HTTP server class
Description :
Instances of the HTTP::Daemon class are HTTP/1.1 servers that listen on a
socket for incoming requests. The HTTP::Daemon is a subclass of
IO::Socket::IP, so you can perform socket operations directly on it too.

--------------------------------------------------------------------------------
Update Information:

Changes:
6.17      2026-05-19 23:11:06Z
Fix CVE-2026-8450 (affects 6.15 and earlier): 2-arg open() in
    send_file() enabled RCE / arbitrary file write / response-body
    exfiltration when a string argument was derived from attacker-
    influenced input. send_file() now uses 3-arg open() with an
    explicit '<' read mode, so the path is always treated as a literal
    filename and 2-arg open() shell-magic shapes ('| cmd', 'cmd |',
    '> path', etc.) are no longer interpreted. send_file() now also
    returns '0E0' (true zero) on a successful zero-byte transfer so
    callers can distinguish empty file from open failure (undef). See
    https://www.cve.org/CVERecord?id=CVE-2026-8450 for the advisory.
    Reported and patched by Stig Palmquist (stigtsp). (Stig Palmquist,
    Olaf Alders)
--------------------------------------------------------------------------------
ChangeLog:

* Wed May 20 2026 Michal Josef Špaček <mspacek@redhat.com> - 6.17-1
- 6.17 bump
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #2480076 - perl-HTTP-Daemon-6.17 is available
        https://bugzilla.redhat.com/show_bug.cgi?id=2480076
--------------------------------------------------------------------------------

This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2026-8982379b5c' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgr...

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------



Attachment: None (type=text/plain)
-- 
_______________________________________________
package-announce mailing list -- package-announce@lists.fedoraproject.org
To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-cond...
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/package-ann...
Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new