Memcached Command Injection Vulnerability in HTTP::Session for Perl

CVE-2011-10042

What is CVE-2011-10042?

The HTTP::Session module for Perl is susceptible to a command injection vulnerability due to the improper handling of session IDs within memcached. In versions prior to 0.43, session IDs derived from client cookies can be manipulated to include carriage return (CR) and line feed (LF) characters. This allows an attacker to prematurely terminate the cache command and inject additional commands, potentially compromising the system's integrity and exposing sensitive information. It is crucial to update to the latest version to mitigate this risk.

References