Nixpkgs security tracker
by @LeSuisse Activity log
- Created suggestion
-
@LeSuisse
ignored
52 packages
- perlPackages.TaskPlack
- perl5Packages.TaskPlack
- perl538Packages.TaskPlack
- perl540Packages.TaskPlack
- perlPackages.PlackAppProxy
- perl5Packages.PlackAppProxy
- perl538Packages.PlackAppProxy
- perl540Packages.PlackAppProxy
- perlPackages.PlackMiddlewareDebug
- perl5Packages.PlackMiddlewareDebug
- perlPackages.PlackMiddlewareHeader
- perl5Packages.PlackMiddlewareHeader
- perlPackages.PlackMiddlewareSession
- perl538Packages.PlackMiddlewareDebug
- perl540Packages.PlackMiddlewareDebug
- perl5Packages.PlackMiddlewareSession
- perlPackages.PlackMiddlewareDeflater
- perlPackages.PlackTestExternalServer
- perl538Packages.PlackMiddlewareHeader
- perl540Packages.PlackMiddlewareHeader
- perl5Packages.PlackMiddlewareDeflater
- perl5Packages.PlackTestExternalServer
- perl538Packages.PlackMiddlewareSession
- perl540Packages.PlackMiddlewareSession
- perlPackages.PlackMiddlewareAuthDigest
- perl538Packages.PlackMiddlewareDeflater
- perl538Packages.PlackTestExternalServer
- perl540Packages.PlackMiddlewareDeflater
- perl540Packages.PlackTestExternalServer
- perl5Packages.PlackMiddlewareAuthDigest
- perlPackages.PlackMiddlewareReverseProxy
- perl538Packages.PlackMiddlewareAuthDigest
- perl540Packages.PlackMiddlewareAuthDigest
- perl5Packages.PlackMiddlewareReverseProxy
- perlPackages.PlackMiddlewareConsoleLogger
- perl5Packages.PlackMiddlewareConsoleLogger
- perlPackages.PlackMiddlewareMethodOverride
- perl538Packages.PlackMiddlewareReverseProxy
- perl540Packages.PlackMiddlewareReverseProxy
- perl5Packages.PlackMiddlewareMethodOverride
- perl538Packages.PlackMiddlewareConsoleLogger
- perl540Packages.PlackMiddlewareConsoleLogger
- perl538Packages.PlackMiddlewareMethodOverride
- perl540Packages.PlackMiddlewareMethodOverride
- perlPackages.PlackMiddlewareRemoveRedundantBody
- perl5Packages.PlackMiddlewareRemoveRedundantBody
- perl538Packages.PlackMiddlewareRemoveRedundantBody
- perl540Packages.PlackMiddlewareRemoveRedundantBody
- perlPackages.PlackMiddlewareFixMissingBodyInRedirect
- perl5Packages.PlackMiddlewareFixMissingBodyInRedirect
- perl538Packages.PlackMiddlewareFixMissingBodyInRedirect
- perl540Packages.PlackMiddlewareFixMissingBodyInRedirect
- @LeSuisse ignored reference https://n…
- @LeSuisse accepted
- @LeSuisse published on GitHub
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting
Plack::Middleware::XSendfile versions through 1.0053 for Perl can allow client-controlled path rewriting. Plack::Middleware::XSendfile allows the variation setting (sendfile type) to be set by the client via the X-Sendfile-Type header, if it is not considered in the middleware constructor or the Plack environment. A malicious client can set the X-Sendfile-Type header to "X-Accel-Redirect" to services running behind nginx reverse proxies, and then set the X-Accel-Mapping to map the path to an arbitrary file on the server. Since 1.0053, Plack::Middleware::XSendfile is deprecated and will be removed from future releases of Plack. This is similar to CVE-2025-61780 for Rack::Sendfile, although Plack::Middleware::XSendfile has some mitigations that disallow regular expressions to be used in the mapping, and only apply the mapping for the "X-Accel-Redirect" type.
References
-
https://metacpan.org/release/MIYAGAWA/Plack-1.0053/view/lib/Plack/Middleware/XS… technical-description
Ignored references (1)
Affected products
- =<1.0053
Matching in nixpkgs
pkgs.perlPackages.Plack
Perl Superglue for Web frameworks and Web Servers (PSGI toolkit)
pkgs.perl5Packages.Plack
Perl Superglue for Web frameworks and Web Servers (PSGI toolkit)
pkgs.perl538Packages.Plack
Perl Superglue for Web frameworks and Web Servers (PSGI toolkit)
pkgs.perl540Packages.Plack
Perl Superglue for Web frameworks and Web Servers (PSGI toolkit)
Ignored packages (52)
pkgs.perlPackages.TaskPlack
Plack bundle
pkgs.perl5Packages.TaskPlack
Plack bundle
pkgs.perl538Packages.TaskPlack
Plack bundle
pkgs.perl540Packages.TaskPlack
Plack bundle
pkgs.perlPackages.PlackAppProxy
Proxy requests
pkgs.perl5Packages.PlackAppProxy
Proxy requests
pkgs.perl538Packages.PlackAppProxy
Proxy requests
pkgs.perl540Packages.PlackAppProxy
Proxy requests
pkgs.perlPackages.PlackMiddlewareDebug
Display information about the current request/response
pkgs.perl5Packages.PlackMiddlewareDebug
Display information about the current request/response
pkgs.perlPackages.PlackMiddlewareHeader
Modify HTTP response headers
pkgs.perl5Packages.PlackMiddlewareHeader
Modify HTTP response headers
pkgs.perlPackages.PlackMiddlewareSession
Middleware for session management
pkgs.perl538Packages.PlackMiddlewareDebug
Display information about the current request/response
pkgs.perl540Packages.PlackMiddlewareDebug
Display information about the current request/response
pkgs.perl5Packages.PlackMiddlewareSession
Middleware for session management
pkgs.perlPackages.PlackMiddlewareDeflater
Compress response body with Gzip or Deflate
pkgs.perlPackages.PlackTestExternalServer
Run HTTP tests on external live servers
pkgs.perl538Packages.PlackMiddlewareHeader
Modify HTTP response headers
pkgs.perl540Packages.PlackMiddlewareHeader
Modify HTTP response headers
pkgs.perl5Packages.PlackMiddlewareDeflater
Compress response body with Gzip or Deflate
pkgs.perl5Packages.PlackTestExternalServer
Run HTTP tests on external live servers
pkgs.perl538Packages.PlackMiddlewareSession
Middleware for session management
pkgs.perl540Packages.PlackMiddlewareSession
Middleware for session management
pkgs.perlPackages.PlackMiddlewareAuthDigest
Digest authentication
pkgs.perl538Packages.PlackMiddlewareDeflater
Compress response body with Gzip or Deflate
pkgs.perl538Packages.PlackTestExternalServer
Run HTTP tests on external live servers
pkgs.perl540Packages.PlackMiddlewareDeflater
Compress response body with Gzip or Deflate
pkgs.perl540Packages.PlackTestExternalServer
Run HTTP tests on external live servers
pkgs.perl5Packages.PlackMiddlewareAuthDigest
Digest authentication
pkgs.perlPackages.PlackMiddlewareReverseProxy
Supports app to run as a reverse proxy backend
pkgs.perl538Packages.PlackMiddlewareAuthDigest
Digest authentication
pkgs.perl540Packages.PlackMiddlewareAuthDigest
Digest authentication
pkgs.perl5Packages.PlackMiddlewareReverseProxy
Supports app to run as a reverse proxy backend
pkgs.perlPackages.PlackMiddlewareConsoleLogger
Write logs to Firebug or Webkit Inspector
pkgs.perl5Packages.PlackMiddlewareConsoleLogger
Write logs to Firebug or Webkit Inspector
pkgs.perlPackages.PlackMiddlewareMethodOverride
Override REST methods to Plack apps via POST
pkgs.perl538Packages.PlackMiddlewareReverseProxy
Supports app to run as a reverse proxy backend
pkgs.perl540Packages.PlackMiddlewareReverseProxy
Supports app to run as a reverse proxy backend
pkgs.perl5Packages.PlackMiddlewareMethodOverride
Override REST methods to Plack apps via POST
pkgs.perl538Packages.PlackMiddlewareConsoleLogger
Write logs to Firebug or Webkit Inspector
pkgs.perl540Packages.PlackMiddlewareConsoleLogger
Write logs to Firebug or Webkit Inspector
pkgs.perl538Packages.PlackMiddlewareMethodOverride
Override REST methods to Plack apps via POST
pkgs.perl540Packages.PlackMiddlewareMethodOverride
Override REST methods to Plack apps via POST
pkgs.perlPackages.PlackMiddlewareRemoveRedundantBody
Plack::Middleware which removes body for HTTP response if it's not required
pkgs.perl5Packages.PlackMiddlewareRemoveRedundantBody
Plack::Middleware which removes body for HTTP response if it's not required
pkgs.perl538Packages.PlackMiddlewareRemoveRedundantBody
Plack::Middleware which removes body for HTTP response if it's not required
pkgs.perl540Packages.PlackMiddlewareRemoveRedundantBody
Plack::Middleware which removes body for HTTP response if it's not required
pkgs.perlPackages.PlackMiddlewareFixMissingBodyInRedirect
Plack::Middleware which sets body for redirect response, if it's not already set
pkgs.perl5Packages.PlackMiddlewareFixMissingBodyInRedirect
Plack::Middleware which sets body for redirect response, if it's not already set
pkgs.perl538Packages.PlackMiddlewareFixMissingBodyInRedirect
Plack::Middleware which sets body for redirect response, if it's not already set
pkgs.perl540Packages.PlackMiddlewareFixMissingBodyInRedirect
Plack::Middleware which sets body for redirect response, if it's not already set