Your message dated Tue, 20 Jul 2021 14:35:21 +0000
with message-id <[email protected]>
and subject line Bug#982294: fixed in collectd 5.12.0-7
has caused the Debian Bug report #982294,
regarding collectd-core: CGI::param called in list context raise error in
Collectd/Graph/Common.pm
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
982294: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982294
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: collectd-core
X-Debbugs-Cc: [email protected]
Version: 5.12.0-5
Severity: normal
Tags: patch
When using collection3 as a CGI, the following error is sent to logs repeatedly.
FastCGI sent in stderr: "CGI::param called in list context from
/usr/share/doc/collectd-core/examples/collection3/lib/Collectd/Graph/Common.pm
line 529, this can lead to vulnerabilities. See the warning in "Fetching the
value or values of a single named parameter" at /usr/share/perl5/CGI.pm line
412"
This is caused inappropriate usage of param(),
it should be handled as a scalar or should be treated by multi_param()
explicitly.
Reproducible steps:
1. setup collection3 (examples/collection3) like this.
location /share/ {
alias /usr/share/doc/collectd-core/examples/collection3/share/;
}
location ^~ /collection3/ {
alias /usr/share/doc/collectd-core/examples/collection3/bin/;
fastcgi_pass unix:/var/run/fcgiwrap.socket;
include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $request_filename;
fastcgi_index index.cgi;
}
2. access collection3 via browser
3. select "Data selection" and click OK button
--- a/contrib/collection3/lib/Collectd/Graph/Common.pm
+++ b/contrib/collection3/lib/Collectd/Graph/Common.pm
@@ -526,7 +526,7 @@
for (qw(hostname plugin plugin_instance type type_instance))
{
my $part = $_;
- my @temp = param ($part);
+ my @temp = multi_param ($part);
if (!@temp)
{
next;
@@ -547,9 +547,9 @@
sub get_timespan_selection
{
my $ret = 86400;
- if (param ('timespan'))
+ if (scalar param ('timespan'))
{
- my $temp = int (param ('timespan'));
+ my $temp = int (scalar param ('timespan'));
if ($temp && ($temp > 0))
{
$ret = $temp;
@@ -568,7 +568,7 @@
$ret{$_} = 0;
}
- for (param ('hostname'))
+ for (multi_param ('hostname'))
{
my $host = _sanitize_generic_allow_minus ($_);
if (defined ($ret{$host}))
@@ -597,7 +597,7 @@
$ret{$_} = 0;
}
- for (param ('plugin'))
+ for (multi_param ('plugin'))
{
if (defined ($ret{$_}))
{
--- End Message ---
--- Begin Message ---
Source: collectd
Source-Version: 5.12.0-7
Done: Kentaro Hayashi <[email protected]>
We believe that the bug you reported is fixed in the latest version of
collectd, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Kentaro Hayashi <[email protected]> (supplier of updated collectd package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 14 Jul 2021 21:46:02 +0900
Source: collectd
Architecture: source
Version: 5.12.0-7
Distribution: unstable
Urgency: medium
Maintainer: Collectd Packaging Team <[email protected]>
Changed-By: Kentaro Hayashi <[email protected]>
Closes: 982294
Changes:
collectd (5.12.0-7) unstable; urgency=medium
.
* Team upload.
* Fix CGI::param error in collection3 (Closes: 982294)
Checksums-Sha1:
ac7ec24cd9b3377a40e34923bba3391542ed7f4b 4266 collectd_5.12.0-7.dsc
19120ad55fb872a1b26e7a881aba7dbdf3b4c353 1162056 collectd_5.12.0.orig.tar.xz
0be81241234bcae34f4a1e42a289c15a00850cfe 80136 collectd_5.12.0-7.debian.tar.xz
8cd38af32afb02b97002934cacec48bfa984e230 10510
collectd_5.12.0-7_source.buildinfo
Checksums-Sha256:
a4c3a6dfa6fc931780ca8466a561c1a9fbb6e18588d7048926c10e5e333c337f 4266
collectd_5.12.0-7.dsc
9ccc5ebb9884a8fca1c4cdbd48d45c5875d683330a482d09da4fe2c571f3b536 1162056
collectd_5.12.0.orig.tar.xz
b1aafe6ff740443b2d8259adf29bd37fc52bb165e0110bf4e92c2dae24cf1430 80136
collectd_5.12.0-7.debian.tar.xz
121b6e8eeed28abdb485b8272bc8ed803a75a59e46c6beb04c323d39498ae9d2 10510
collectd_5.12.0-7_source.buildinfo
Files:
38b3efe80b70a6b4ee93e0c8951e431f 4266 utils optional collectd_5.12.0-7.dsc
66e38bc99e15b942ffccb9c62a9d2e9f 1162056 utils optional
collectd_5.12.0.orig.tar.xz
b534a41ece81414486b5ea3d1c9ae7c7 80136 utils optional
collectd_5.12.0-7.debian.tar.xz
b1ee9beb8fe24c3e710ce1cf356709dd 10510 utils optional
collectd_5.12.0-7_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEcZ6y2T2+nE0h+6Bk9/t1xWbtIOMFAmD207oACgkQ9/t1xWbt
IOPs9w/9E3WTBkD3v2p6OfLeiLKBtHuzu+F4ZIjuS+RjLnkQ2ty5dsv3Fw+IPJ1U
CSY/dasFI+T28GikbahiPnnjS8GHFCbTHYDztcu0pVM7sB8+2MqG2sCg/BAmxrpo
m82N3mR2B+DbVMisiti5Q6G7w60O85g5nWtpRd3tqFnP4fDxTxTphkz9En/C8Fc4
JxmfiQEYqwlFkmJQ4CmYnQvFIq5vCQwDegjGpRXl+/cS0pX65FVFMrT2rDgDa/XF
jYYfVKUArMNSIlWyOePWJZV/ynseNLFhK3HB5NymhyOfAj1tRNrakGSUZwmNI/C9
TK5530ypiECgnyo4RIVFYf8PvUvbT+jl9F2ktF0A8DTw//al+rGgxBLbg1+2iiwg
JVLzW9ZlEo1qTgV7RiFOVz1niXHR7CSxO9WJtxP5KBSGtoeKMs7Mn8Y20yu6v+jd
PZWTf8790Rtj8FTP1fKRTRB6cntELsa5H1wMV2FuQNcBNdZ5V5WUQRnOZegijpom
qGJ3o5MKck6M7xC9mWtft/PxFXr3A35TClnWDhbSWIn2lXZ9Sepcihj2soz2eIZv
mimqcaq+HJURtirowAnaEfd1cdFQ3URu4ECO0Y6QQPKGF/lfTR4+lyMTX/LW+rQt
plZx1MXikA8B/cN5Ja2Mo+jt1XZYcfzf0UtY0a7Mns7RCzzIxw4=
=CyEd
-----END PGP SIGNATURE-----
--- End Message ---
