A flaw was found in Perl versions 5.22 through 5.26. Heap-buffer-overflow read in regcomp.c Upstream Patch: https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62
Upstream ticket: https://rt.perl.org/Public/Bug/Display.html?id=133192
Downgrading severity based on: - significant control over a regex gives a number of vectors to deny service, if not evaluate code - information disclosure potential is through error messages, which should not be disclosed to attackers from secure systems
Acknowledgments: Name: the Perl project Upstream: Eiichi Tsukata
Created perl tracking bugs for this issue: Affects: fedora-all [bug 1654921]
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Via RHSA-2019:0001 https://access.redhat.com/errata/RHSA-2019:0001
This issue has been addressed in the following products: Red Hat Software Collections for Red Hat Enterprise Linux 7 Red Hat Software Collections for Red Hat Enterprise Linux 7.4 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.5 EUS Red Hat Software Collections for Red Hat Enterprise Linux 7.6 EUS Red Hat Software Collections for Red Hat Enterprise Linux 6 Via RHSA-2019:0010 https://access.redhat.com/errata/RHSA-2019:0010
openshift-enterprise-3: notaffected. I reviewed OpenShift containers for applications with dependencies on perl and was unable to identify any where the perl interpreter would be exposed to attacker-controlled regular expressions which could expose this flaw. There is a perl dependency in our MariaDB packaging, however the only non-test related perl usage is in a backup script (mysqlhotcopy) which is not exposed to attacker-controlled regular expressions. I have not filed trackers as these images will inherit the existing perl fixes next time they are respun. See also https://access.redhat.com/articles/2803031