CVE-2022-4993
Description
A flaw was found in HTML::FormHandler for Perl. The _apply_actions and add_error functions process error message text, which can be influenced by user-supplied request data, as a template. A remote attacker can exploit this by crafting malicious input, leading to unhandled exceptions that terminate the process or cause arbitrary memory allocation, resulting in a Denial of Service (DoS) due to resource exhaustion.
Statement
This vulnerability is rated as Important severity because unauthenticated remote attackers can submit specially crafted form parameters to trigger excessive memory consumption or process crashes, directly causing a denial of service. The perl-HTML-FormHandler component is not distributed with supported Red Hat Enterprise Linux releases and is only maintained within Fedora community packages. Applications utilizing this library in custom environments are exposed when handling untrusted user input through forms that execute validation or type constraints.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
