From b382f2321b13b26d818353563b598857fccc6790 Mon Sep 17 00:00:00 2001 From: "mkanat%bugzilla.org" Date: Thu, 11 Nov 2010 02:20:43 +0000 Subject: [PATCH] Bug 591165: (CVE-2010-2761) [SECURITY] Bump minimum required version of CGI.pm to v3.50 in order to address header injection vulnerability. [r=mkanat a=mkanat] git-svn-id: svn://10.0.0.236/branches/BUGZILLA-3_6-BRANCH@261557 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/webtools/bugzilla/.bzrrev | 2 +- .../webtools/bugzilla/Bugzilla/Install/Requirements.pm | 9 +++------ 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/mozilla/webtools/bugzilla/.bzrrev b/mozilla/webtools/bugzilla/.bzrrev index 0f72eb279bf..dfc02e8b2de 100644 --- a/mozilla/webtools/bugzilla/.bzrrev +++ b/mozilla/webtools/bugzilla/.bzrrev @@ -1 +1 @@ -7206 \ No newline at end of file +7207 \ No newline at end of file diff --git a/mozilla/webtools/bugzilla/Bugzilla/Install/Requirements.pm b/mozilla/webtools/bugzilla/Bugzilla/Install/Requirements.pm index bb078e9b9f1..8a7939afbb7 100644 --- a/mozilla/webtools/bugzilla/Bugzilla/Install/Requirements.pm +++ b/mozilla/webtools/bugzilla/Bugzilla/Install/Requirements.pm @@ -66,12 +66,9 @@ sub REQUIRED_MODULES { { package => 'CGI.pm', module => 'CGI', - # Perl 5.10 requires CGI 3.33 due to a taint issue when - # uploading attachments, see bug 416382. - # Require CGI 3.21 for -httponly support, see bug 368502. - version => (vers_cmp($perl_ver, '5.10') > -1) ? '3.33' : '3.21', - # CGI::Carp in 3.46 and 3.47 breaks Template Toolkit - blacklist => ['^3\.46$', '^3\.47$'], + # 3.50 fixes a security problem that affects Bugzilla. + # (bug 591165) + version => '3.50', }, { package => 'Digest-SHA',