CVE-2019-20919: Null Pointer Dereference
An issue was discovered in the DBI module before 1.643 for Perl. The hvfetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-20919?
CVE-2019-20919 is a vulnerability in the Perl DBI module that can cause a NULL pointer dereference.
How severe is CVE-2019-20919?
CVE-2019-20919 has a severity level of 4.7, which is considered medium.
Which software is affected by CVE-2019-20919?
The following software packages are affected by CVE-2019-20919: libdbi-perl (versions 1.642-1+deb10u2, 1.643-3, 1.643-4) on Debian, libdbi-perl (version 1.640-1ubuntu0.2) on Ubuntu (bionic), libdbi-perl (version 1.630-1ubuntu0.1~) on Ubuntu (trusty), libdbi-perl (version 1.643-1) on Ubuntu (upstream), libdbi-perl (version 1.634-1ubuntu0.2) on Ubuntu (xenial), Perl DBI (version up to 1.643), Fedora (version 31), Canonical Ubuntu Linux (versions 12.04, 14.04, 16.04, 18.04), Debian Linux (version 9.0), and openSUSE Leap (versions 15.1, 15.2).
How can I fix CVE-2019-20919?
To fix CVE-2019-20919, you should update to the patched versions of the affected software packages. Refer to the documentation provided by the relevant sources.
Where can I find more information about CVE-2019-20919?
You can find more information about CVE-2019-20919 at the following references: [GitHub](https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc67ff), [MetaCPAN](https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643-), [Fedora package announce](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JXLKODJ7B57GITDEZZXNSHPK4VBYXYHR/).