Several issues in libpve-http-server-perl

Details

Several issues were found and fixed in the Perl HTTP server used by Proxmox VE and Proxmox Mail Gateway.

The access log handling was improved to avoid interleaved writes to the log file and injection of unescaped special values in log lines.

The request handling was improved to reject duplicate Content-Length, Host or Cookie HTTP header values, to avoid mapping underscores to hyphens in HTTP header names and to reject requests with extremely long query strings.

The duplicate header value issue was reported privately by Apo - CSB Raccoon Labs <[email protected]>, the rest was found internally.

Fixed in

• libpve-http-server-perl >= 6.0.6