{"affected":[{"defaultStatus":"unaffected","ecosystem":"cpan","packageName":"http-session","product":"","source":"CNA: CPANSec","vendor":"","versions":[{"lessThan":"0.43","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2011-10042","cwes":["CWE-93"],"description":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.\n\nThe session id from the client's cookie reaches memcached unchanged as the cache key.\n\nA CR and LF in the session id end the cache command early, and the server reads the bytes after them as further commands.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794664558977,"publishedAt":1794664558977,"references":[{"source":"CNA: CPANSec","tags":["patch"],"url":"https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch"},{"source":"CNA: CPANSec","tags":["release-notes"],"url":"https://metacpan.org/release/TOKUHIROM/HTTP-Session-0.42/changes"}],"remediation":[{"kind":"fix","source":"CNA: CPANSec","text":"Upgrade to HTTP::Session 0.43 or later.\n\nNote that HTTP::Session 0.54 includes additional security fixes, but has been marked as deprecated.  Users should migrate to an alternative such as Plack::Middleware::Session."},{"kind":"fix","source":"CNA: CPANSec","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/tokuhirom/http-session/commit/039345db9bc9311868019fde67b89c355114a3d3.patch"}],"revision":"f93b697cdb4cd8e2d16e02d24654ee2669df4d980aa6ee36d7a8472a0b3c2e57","sources":[{"modifiedAt":1794664558977,"name":"CNA: CPANSec","retrievedAt":1794665300205,"url":"https://www.cve.org/CVERecord?id=CVE-2011-10042"}],"ssvc":null,"status":"published","title":"HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached","updatedAt":1794665300205}