Bug 17239

Summary: Vulnerabilitiy warning for package C4::Biblio
Product: Koha Reporter: Marc Véron <veron>
Component: Architecture, internals, and plumbingAssignee: Bugs List <koha-bugs>
Status: NEW --- QA Contact: Testopia <testopia>
Severity: normal    
Priority: P5 - low CC: brendan, f.demians, jonathan.druart, julian.maurice, katrin.fischer, kyle, m.de.rooy
Version: unspecified   
Hardware: All   
OS: All   
See Also: https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=29771
Change sponsored?: --- Patch complexity: ---
Documentation contact: Documentation submission:
Text to go in the release notes:
Version(s) released in:

Description Marc Véron 2016-09-02 09:11:13 UTC
I got following warning in plack error log while verifying Bug 17206:

CGI::param called in list context from package C4::Biblio line 2605, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Marcel de Rooy 2016-09-02 11:22:51 UTC
For these param/multi_param reports you do not (really) need Koha security.
Comment 2 Jonathan Druart 2016-09-07 09:47:20 UTC
Steps to recreate?
Comment 3 Jonathan Druart 2016-11-17 09:36:01 UTC
Marc, is it still valid?
Comment 4 Jonathan Druart 2016-11-17 09:36:18 UTC
I guess it comes from

2623             my $ind1 = _default_ind_to_space( substr( $cgi->param($param), 0, 1 ) );
2624             my $ind2 = _default_ind_to_space( substr( $cgi->param( $params[ $i + 1 ] ), 0, 1 ) );
Comment 5 Marc Véron 2016-11-17 11:11:41 UTC
(In reply to Jonathan Druart from comment #3)
> Marc, is it still valid?

Sorry, I have no time to test at the moment.
Comment 6 Jonathan Druart 2017-08-09 16:54:10 UTC
This is not a security bug, moving out the Koha security project.