REDHAT-BUG-576508
First published: Wed Mar 24 2010(Updated: )
Safe.pm 2.24 and earlier, when used in Perl 5.10.0 and earlier, may allow attackers to break out of safe compartment in (1) Safe::reval or (2) Safe::rdo using implicitly called methods (such as DESTROY or AUTOLOAD) on implicitly blessed Perl objects, returned as a result of unsafe code evaluation. These methods could have been executed unrestricted by Safe, when such objects were accessed or destroyed. If a victim was tricked into running a specially-crafted Perl script, using Safe extension module, it could lead to intended Safe module restriction bypass. Different vulnerability than <a href="https://access.redhat.com/security/cve/CVE-2010-1447">CVE-2010-1447</a>. Solution: Upgrade to Safe.pm v2.25 or higher. References: [1] <a href="http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm">http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm</a> Acknowledgements: Red Hat would like to thank Tim Bunce for responsibly reporting this issue. Upstream acknowledges Nick Cleaton as the original reporter.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| CPAN | <2.25 | |
| Perl 5.30.0 | <5.10.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/security/cve/CVE-2010-1447
- http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm
- https://access.redhat.com/security/cve/CVE-2010-1168
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=593857
- https://rhn.redhat.com/errata/RHSA-2010-0457.html
- https://rhn.redhat.com/errata/RHSA-2010-0458.html
- https://bugzilla.redhat.com/show_bug.cgi?id=576508
Frequently Asked Questions
What is the severity of REDHAT-BUG-576508?
The severity of REDHAT-BUG-576508 is considered moderate as it can lead to unauthorized access through escaping the safe compartment.
How do I fix REDHAT-BUG-576508?
To fix REDHAT-BUG-576508, upgrade Safe.pm to version 2.25 or later and ensure you are using Perl version later than 5.10.0.
What versions are affected by REDHAT-BUG-576508?
REDHAT-BUG-576508 affects Safe.pm versions up to 2.24 and Perl versions up to 5.10.0.
What systems are impacted by REDHAT-BUG-576508?
Systems using Safe.pm versions 2.24 and earlier along with Perl versions 5.10.0 and earlier are impacted by REDHAT-BUG-576508.
Are there any workarounds for REDHAT-BUG-576508?
There are no reliable workarounds for REDHAT-BUG-576508; upgrading to the patched versions is the recommended approach.
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2010-1168
- agent/last-modified-date
- agent/first-publish-date
- agent/source
- agent/severity
- agent/description
- agent/references
- agent/event
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cpan
- canonical/cpan
- vendor/perl
- canonical/perl 5.30.0