CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name.

login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a name containing a newline followed by text in the log record format adds a forged record.

An unauthenticated attacker can forge log records, such as a successful administrator login from an address of their choosing.

Üreticinin çözüm notu (İngilizce)

Upgrade to CallBackery 0.62.0 or later.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• metacpan.org/release/OETIKER/CallBackery-0.62.0/changes Diğer

Kayıt geçmişi

1. 6 Kas 2026 20:00CVSS puanı değişti: – → 9.8
2. 30 Eki 2026 16:10Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118986CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
• 5,3 CVE-2026-118987CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
• 5,5 CVE-2026-118990CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
• 7,5 CVE-2026-118991CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
• 8,4 CVE-2026-118992CallBackery (Perl) yapılandırma yedeği geri yüklemede işletim sistemi komutu çalıştırma
• 7,5 CVE-2026-118993CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI