Perl script fails in apache with the error 'Can't locate object method "set" via package "APR::Table"'

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 5.5
  • Lemonldap
  • httpd
  • perl-5.8.8-32.el5_5.1

Issue

  • Following errors seen in apache error log:
[Tue Jun 08 16:45:59 2010] [error] [client 127.0.0.1] Can't locate object method "set" via package "APR::Table" at /usr/lib/perl5/vendor_perl/5.8.8/Lemonldap/NG/Handler/Simple.pm line 234.\\n, referer: https://domain.ltd/?url=aHR0cHM6Ly9vYm0uZ2VubmV2aWxsaWVycy5pbmZvLw==

Resolution

  • This is a bug in Lemonldap.
  • A workaround is to downgrade the perl package from perl 5.8.8-32.el5_5.1 to perl 5.8.8-27.el5, but is not really recommended since it reintroduces security vulnerabilities in perl.

Root Cause

  • The fix to bug 576508 has introduced this behaviour
  • Lemonldap tries to refer an external object from inside a safe object, which should not be allowed. The perl 5.8.8-27.el5 version has a security vulnerability which allowed this behaviour. The recent fix has closed the vulnerability, hence exposing the Lemonldap bug.

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.