Bug 1877447 (CVE-2013-7491)

Summary:	CVE-2013-7491 perl-dbi: Stack corruption on callbacks
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	caillon+fedoraproject, dmoppert, hhorak, john.j5live, jorton, jplesnik, kasal, perl-devel, perl-maint-list, ppisar, rhughes, rstrode, vondruch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	perl-DBi 1.628	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-11-02 17:39:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1877962
Bug Blocks:	1857388

Description Pedro Sampaio 2020-09-09 16:20:02 UTC

A flaw was found in perl-dbi before version 1.628. A problem occurs when a user-defined function requires a non-trivial amount of memory and the perl stack gets reallocated.

References:

https://rt.cpan.org/Public/Bug/Display.html?id=85562

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/401f1221311c71f760e21c98772f0f7e3cbead1d

Comment 3 Todd Cullum 2020-09-14 18:59:10 UTC

Statement:

perl-DBI as shipped in Red Hat Enterprise Linux 8, rhscl-3 rh-perl526-perl-DBI and rhscl-3 rh-perl530-perl-DBI are notaffected by this flaw as the vulnerable code has already been patched in versions of perl-DBI shipped in these products.