CVE-2021-36770: High severity IBM Cognos Analytics vulnerability
Encode could allow a local authenticated attacker to gain elevated privileges on the system, caused by an untrusted search path flaw. By using a specially-crafted Encode::ConfigLocal library, an attacker could exploit this vulnerability to gain elevated privileges.
Other sources
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libencode-perlto a version that resolves this vulnerability.Fixed in 3.08-1+deb11u2Fixed in 3.08-1+deb11u1Fixed in 3.19-1Fixed in 3.21-1 - Upgrade
Upgrade
debian/perlto a version that resolves this vulnerability.Fixed in 5.32.1-4+deb11u3Fixed in 5.32.1-4+deb11u4Fixed in 5.36.0-7+deb12u3Fixed in 5.36.0-7+deb12u2Fixed in 5.40.1-6Fixed in 5.40.1-7
Event History
Frequently Asked Questions
What is CVE-2021-36770?
CVE-2021-36770 is a vulnerability in Perl through 5.34.0 that allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library.
How can local users exploit CVE-2021-36770?
Local users can exploit CVE-2021-36770 by placing a specially crafted Encode::ConfigLocal library in the current working directory to preempts dynamic module loading.
Which versions of Perl and libencode-perl are affected by CVE-2021-36770?
Versions 3.00-1+deb10u1, 3.08-1+deb11u2, 3.08-1+deb11u1, 3.19-1 of libencode-perl and versions 5.28.1-6+deb10u1, 5.32.1-4+deb11u2, 5.32.1-4+deb11u1, 5.36.0-7, 5.36.0-9 of Perl are affected by CVE-2021-36770.
What is the severity of CVE-2021-36770?
CVE-2021-36770 has a severity rating of 7.8 (high).
How can I mitigate the vulnerability CVE-2021-36770?
To mitigate CVE-2021-36770, it is recommended to update to the fixed versions of Perl (above 5.36.0-9) and libencode-perl (above 3.19-1).