Net::Statsd::Lite Metric Injection Vulnerability

A vulnerability in Net::Statsd::Lite for Perl, affecting versions prior to 0.10.0, allowed for metric injections. The issue arose because the set_add method did not validate metric names against newlines, colons, or pipes. This oversight enabled the injection of additional StatsD metrics from untrusted sources.

Impact

Exploitation of this vulnerability could lead to unauthorized metric injections, allowing manipulation of StatsD data.

Remediation

Users can upgrade to Net::Statsd::Lite version 0.10.1 or later, where this vulnerability has been addressed. Version 0.9.0 also fixed a similar issue related to metric name validation.