What’s Vulnerable › Vulnerabilities

CVE-2007-1349

• Severity: medium (CVSS 5.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 10.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2007-03-30 · updated 2026-06-16
• Weakness: CWE-20

Description

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

Affected products

• Apache Mod Perl: before 1.30; from 2.0.0 through 2.0.11 — fixed in 1.30
• Canonical Ubuntu Linux: 6.06, 6.10, 7.04
• RedHat Enterprise Linux Desktop: 3.0, 4.0, 5.0
• RedHat Enterprise Linux Eus: 4.5
• RedHat Enterprise Linux Server: 3.0, 4.0, 5.0
• RedHat Enterprise Linux Workstation: 3.0, 4.0, 5.0
• Red Hat Satellite 6: 5.1

How to fix

Upgrade to a fixed version: Apache Mod Perl 1.30. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2007-0395.html
• http://rhn.redhat.com/errata/RHSA-2008-0630.html
• http://secunia.com/advisories/24678
• http://secunia.com/advisories/24839
• http://secunia.com/advisories/25072
• http://secunia.com/advisories/25110
• http://secunia.com/advisories/25432
• http://secunia.com/advisories/25655
• http://secunia.com/advisories/25730
• http://secunia.com/advisories/25894
• http://secunia.com/advisories/26084

Get alerted when CVE-2007-1349 or the next vulnerability affects your stack