Bug 17239 - Vulnerabilitiy warning for package C4::Biblio
Summary: Vulnerabilitiy warning for package C4::Biblio
Status: NEW
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low normal
Assignee: Bugs List
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-09-02 09:11 UTC by Marc Véron
Modified: 2022-03-04 06:02 UTC (History)
6 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
Circulation function:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Véron 2016-09-02 09:11:13 UTC 
I got following warning in plack error log while verifying Bug 17206:

CGI::param called in list context from package C4::Biblio line 2605, this can lead to vulnerabilities. See the warning in "Fetching the value or values of a single named parameter" at /usr/share/perl5/CGI.pm line 436.
Comment 1 Marcel de Rooy 2016-09-02 11:22:51 UTC 
For these param/multi_param reports you do not (really) need Koha security.
Comment 2 Jonathan Druart 2016-09-07 09:47:20 UTC 
Steps to recreate?
Comment 3 Jonathan Druart 2016-11-17 09:36:01 UTC 
Marc, is it still valid?
Comment 4 Jonathan Druart 2016-11-17 09:36:18 UTC 
I guess it comes from

2623             my $ind1 = _default_ind_to_space( substr( $cgi->param($param), 0, 1 ) );
2624             my $ind2 = _default_ind_to_space( substr( $cgi->param( $params[ $i + 1 ] ), 0, 1 ) );
Comment 5 Marc Véron 2016-11-17 11:11:41 UTC 
(In reply to Jonathan Druart from comment #3)
> Marc, is it still valid?

Sorry, I have no time to test at the moment.
Comment 6 Jonathan Druart 2017-08-09 16:54:10 UTC 
This is not a security bug, moving out the Koha security project.