Bug 1983786 (CVE-2021-36770) - CVE-2021-36770 perl-Encode: bug in local configuration loading allows arbitrary Perl code execution placed under the current working directory
Summary: CVE-2021-36770 perl-Encode: bug in local configuration loading allows arbitra...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2021-36770
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1984005 1991539 1991540 1991541 1991542 1991543
Blocks: 1983787
TreeView+ depends on / blocked
 
Reported: 2021-07-19 19:06 UTC by Guilherme de Almeida Suckevicz
Modified: 2022-04-17 21:30 UTC (History)
17 users (show)

Fixed In Version: p5-encode 3.12
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in perl-Encode, where the Perl5 Encode module loaded modules within the current directory. This flaw allows an attacker with write access to the current directory of a Perl5 process to inject arbitrary Perl code when this module is loaded, which can be used for a local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-10-29 07:23:20 UTC
Embargoed:

Attachments (Terms of Use)

Description Guilherme de Almeida Suckevicz 2021-07-19 19:06:56 UTC 
It was found that the Encode perl5 module attempts to load modules located within the current directory.
An attacker with write access to a directory where Perl is run from could use this flaw to execute perl code when the Encode module is loaded.
Comment 1 Cedric Buissart 2021-07-20 11:45:27 UTC 
The flaw was introduced in p5-Encode 3.05 via https://github.com/dankogai/p5-encode/commit/9c5f5a30
Comment 4 Marian Rehak 2021-08-09 11:51:12 UTC 
Created perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991539]


Created perl-bootstrap:5.30/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991540]


Created perl-bootstrap:5.32/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991541]


Created perl:5.30/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991542]


Created perl:5.32/perl-Encode tracking bugs for this issue:

Affects: fedora-all [bug 1991543]
Comment 6 Cedric Buissart 2021-08-16 11:35:13 UTC 
Upstream fix :
https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74
Note You need to log in before you can comment on or make changes to this bug.