Bug 1877405 (CVE-2019-20919)

Summary: CVE-2019-20919 perl-dbi: NULL profile dereference in dbi_profile()
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: caillon+fedoraproject, hhorak, john.j5live, jorton, jplesnik, kasal, perl-devel, perl-maint-list, ppisar, rhughes, rstrode, vondruch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: perl-DBI 1.643 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-11-02 17:26:15 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1877406, 1877511, 1877512, 1877513, 1877514    
Bug Blocks: 1857388    

Description Pedro Sampaio 2020-09-09 14:53:25 UTC 
A flaw was found in perl-dbi before version 1.643. hv_fetch() documentation requires checking for NULL and the code does that. But then calls SvOK(profile) uncoditionally two lines later lead to a null profile dereference.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc67ff
Comment 1 Pedro Sampaio 2020-09-09 14:53:55 UTC 
Created perl-DBI tracking bugs for this issue:

Affects: fedora-all [bug 1877406]