CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL.
The generatecertificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.
The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.
The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.
For version 1.01, the dropper script is in lib/Crypt/SelfCertificate/sample/validate.p12.
For version 1.05, the dropper script is in lib/Crypt/SelfCertificate/sample/cert7.pem.
The SHA-256 digests of the files are
fbff21f45ff748365062a5e36fb2d72558cad82a507a6f357f320b4fcdf07760 Crypt-SelfCertificate-1.01.tar.gz 27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc lib/Crypt/SelfCertificate/sample/validate.p12
9fdfa7d69b034b77d4510cda567e8da1e486ca81c7daaadc5732a45c41d71991 Crypt-SelfCertificate-1.05.tar.gz 27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc lib/Crypt/SelfCertificate/sample/cert7.pem
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Treat systems on which Crypt::SelfCertificate versions 1.01 through 1.05 were installed as potentially compromised and investigate them accordingly.
Event History
Frequently Asked Questions
What action triggers the malicious behavior?
The behavior is triggered when generate_certificate runs the Python script stored in a certificate-file path. That script attempts to download code from a hardcoded, base64-obfuscated HTTP URL and executes the response directly as the current user.
Which systems are realistically exposed?
Systems with Crypt::SelfCertificate versions 1.01 through 1.05 are at risk if generate_certificate is invoked. The downloaded payload can run with the privileges of the user invoking it, and no separate dropped script is required on the host.
How can I check for known affected package contents?
For version 1.01, inspect lib/Crypt/SelfCertificate/sample/validate.p12, which is identified with SHA-256 27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc; the 1.01 archive digest is fbff21f45ff748365062a5e36fb2d72558cad82a507a6f357f320b4fcdf07760. For version 1.05, the described dropper location is lib/Crypt/SelfCertificate/sample/cert7.pem, and the archive digest is 9fdfa7d69b034b77d4510cda567e8da1e486ca81c7daaadc5732a45c41d71991.
What should be done if patching is not immediately possible?
Do not invoke generate_certificate from affected releases, and prevent those package versions from being installed or used. Restricting outbound HTTP access can reduce the script's ability to retrieve its remote payload, but the available information does not establish this as a complete mitigation.