ALT-PU-2026-18642-3

Package update perl-libwww in branch sisyphus

Version6.83-alt1

Published2026-10-15

Max severityMEDIUM

Severity:

Closed issues (2)

MEDIUM6.5

Уязвимость компонента lib/LWP/UserAgent.pm набора модулей для работы с веб-ресурсами LWP::UserAgent, позволяющая нарушителю получить доступ к конфиденциальным данным

Published: 2026-08-27Modified: 2026-09-16

CVSS 3.xMEDIUM 6.5

CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS 2.0MEDIUM 6.8

CVSS:2.0/AV:N/AC:L/Au:S/C:C/I:N/A:N

References

MEDIUM6.5

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are sent unchanged to the redirect target, including across scheme, host, or port changes. A redirect to an attacker controlled host therefore discloses the caller's credentials to that host.

Published: 2026-05-12Modified: 2026-06-17

CVSS 3.xMEDIUM 6.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References