REDHAT-BUG-2513963: Code Injection
Incomplete fix for CVE-2026-14380 in rhel 9.8.z and 10.2.z.
Details of CVE-2026-14380:
DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.
When a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.
Any caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.
The Profile attribute can be set from three different sources that can carry untrusted data: the DBIPROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.
An attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Perl DBIto a version that resolves this vulnerability.Fixed in 1.650 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2026-14380 - Compensating control
Mitigate until fixed by preventing untrusted callers from influencing the DBI Profile attribute, especially for network-exposed DBI::Gofer/DBI::ProxyServer where per-request DSN values can reach Profile on the broker host.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2513963?
The severity of REDHAT-BUG-2513963 is rated as high with a score of 7.
What vulnerability does REDHAT-BUG-2513963 relate to?
REDHAT-BUG-2513963 is linked to an incomplete fix for CVE-2026-14380 affecting Perl DBI versions before 1.650.
How do I fix REDHAT-BUG-2513963?
To fix REDHAT-BUG-2513963, ensure you update to the latest version of Perl DBI that addresses CVE-2026-14380.
What is the risk associated with REDHAT-BUG-2513963?
The risk associated with REDHAT-BUG-2513963 is categorized as risk level 33.
What type of vulnerability is REDHAT-BUG-2513963?
REDHAT-BUG-2513963 is a code injection vulnerability related to the DBI Profile attribute in Perl.