Source: libdancer2-perl Version: 2.1.0-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for libdancer2-perl. CVE-2026-93709[0]: | Dancer2 versions before 2.2.0 for Perl serve a layout as a page when | an equivalent spelling of its path misses the guard in the AutoPage | handler. The handler compares the request path against the layout | directory name as text, while the lookup that follows canonicalises | it. A doubled slash, a dot segment, a percent-encoded slash, or a | different capitalisation on a case-insensitive filesystem therefore | misses the guard. The handler is off by default, enabled with | auto_page. The layout wrapping every page is already public, so this | discloses one of the application's other layouts. CVE-2026-93710[1]: | Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route | that a dying hook refused when the exception handler halts the | response in compile_hooks. A hook that dies fires | core.app.hook_exception, then calls cleanup unless the failing hook | is the exception handler. A handler that halts does not stop that | cleanup, which discards the request, response and session the | dispatcher has yet to read, so the refused route runs. The handler | has to halt the response object by calling its halt method or | setting is_halted: the halt keyword unwinds through with_return | before cleanup runs. A check in a before hook is not enforced: the | caller gets the refusal, while the route body runs and its writes | land. CVE-2026-93711[2]: | Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from | response header names in headers_to_array. The routine removes CR | and LF from each header value but not from the name. A name carrying | them therefore reaches the PSGI server intact. A server that does | not validate keys writes it to the wire, so the bytes after the CRLF | arrive as their own header line. The application has to derive the | header name from request data, not just the value. An attacker who | controls that data adds their own headers and splits the response. CVE-2026-93712[3]: | Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from | outside public_dir via relative path segments in the File route | handler. The handler joins the request path onto public_dir without | collapsing relative segments, and checks only that the result is a | readable regular file. A request for `/../outside.txt` escapes | public_dir, and percent-encoding the dots reaches the same file. | The handler is off by default. An application is affected once it | names File in route_handlers and sets static_handler to 0, which | otherwise refuses a dot segment before the route runs. Any file the | worker process can read is served to an unauthenticated request, | including the application's config.yml above public_dir. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-93709 https://www.cve.org/CVERecord?id=CVE-2026-93709 [1] https://security-tracker.debian.org/tracker/CVE-2026-93710 https://www.cve.org/CVERecord?id=CVE-2026-93710 [2] https://security-tracker.debian.org/tracker/CVE-2026-93711 https://www.cve.org/CVERecord?id=CVE-2026-93711 [3] https://security-tracker.debian.org/tracker/CVE-2026-93712 https://www.cve.org/CVERecord?id=CVE-2026-93712 Regards, Salvatore
