| Subject: | Session ID possible SQL Injection Patch |
Just uploading the file, so the patches are centralized.
Hardening suggested by http://www.securityfocus.com/bid/26762
The regex is restricted according to the 'create_session_id' function
(Line 1349)
| Subject: | AuthCAS.sid_fix.patch |
--- AuthCAS.pm 2008-01-14 14:00:33.000000000 +0100
+++ AuthCAS.pm.patched 2008-01-14 14:00:33.000000000 +0100
@@ -513,7 +513,8 @@
Apache->warn("$$: CAS: authenticate(): cookie found: '$cookie'") unless ($LOG_LEVEL < $LOG_DEBUG);
# get session id from the cookie
- $cookie =~ /.*$SESSION_COOKIE_NAME=([^;]+)(\s*;.*|\s*$)/;
+ # FIXED according to create_session_id function, because of http://www.securityfocus.com/bid/26762
+ $cookie =~ /.*$SESSION_COOKIE_NAME=([\w\.\/]{32})(\s*;.*|\s*$)/;
$sid = $1 || "";
if (!$sid) {
# no sessions id in cookie?