Bug 1983786 (CVE-2021-36770)

Summary: CVE-2021-36770 perl-Encode: bug in local configuration loading allows arbitrary Perl code execution placed under the current working directory
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bdettelb, caswilli, cbuissar, fjansen, hhorak, jnakfour, jorton, jplesnik, kaycoth, mspacek, perl-devel, perl-maint-list, ppisar, psegedy, security-response-team, tomckay, vmugicag
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: p5-encode 3.12 Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in perl-Encode, where the Perl5 Encode module loaded modules within the current directory. This flaw allows an attacker with write access to the current directory of a Perl5 process to inject arbitrary Perl code when this module is loaded, which can be used for a local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-29 07:23:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1984005, 1991539, 1991540, 1991541, 1991542, 1991543    
Bug Blocks: 1983787    

Description Guilherme de Almeida Suckevicz 2021-07-19 19:06:56 UTC
It was found that the Encode perl5 module attempts to load modules located within the current directory.
An attacker with write access to a directory where Perl is run from could use this flaw to execute perl code when the Encode module is loaded.

Comment 1 Cedric Buissart 2021-07-20 11:45:27 UTC
The flaw was introduced in p5-Encode 3.05 via https://github.com/dankogai/p5-encode/commit/9c5f5a30

Comment 4 Marian Rehak 2021-08-09 11:51:12 UTC
Created perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991539]

Created perl-bootstrap:5.30/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991540]

Created perl-bootstrap:5.32/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991541]

Created perl:5.30/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991542]

Created perl:5.32/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991543]