Bug 2502954 (CVE-2026-64193)
| Summary: | CVE-2026-64193 Net::DNS: Net::DNS: Arbitrary code execution via EDNS EXTENDED ERROR handling | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | urgent | Docs Contact: | |
| Priority: | urgent | ||
| Version: | unspecified | CC: | rhel-process-autobot, watson-tool-maintainers |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Net::DNS. A remote attacker can exploit a vulnerability in the handling of EDNS (Extension Mechanisms for DNS) EXTENDED ERROR options, leading to arbitrary code execution. The affected component processes the `EXTRA-TEXT` field of an EDNS EXTENDED-ERROR option without properly escaping special characters, which allows for command injection. This enables an attacker to execute unauthorized commands on the system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2509246, 2509247 | ||
| Bug Blocks: | |||
Upstream patch: https://metacpan.org/release/NLNETLABS/Net-DNS-1.55_01/diff/NLNETLABS/Net-DNS-1.55/lib/Net/DNS/RR/OPT.pm It combines fixes for two upstream bug reports: https://rt.cpan.org/Public/Bug/Display.html?id=179945 (this issues) https://rt.cpan.org/Public/Bug/Display.html?id=179946 (CVE-2026-64194) The eval was first introduced to _decompose() in Net::DNS::RR::OPT::EXTENDED_ERROR in version 1.37, so earlier versions are unaffected: https://metacpan.org/release/NLNETLABS/Net-DNS-1.37/diff/NLNETLABS/Net-DNS-1.36/lib/Net/DNS/RR/OPT.pm |
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:`"<command>"`} in EXTRA-TEXT.