REDHAT-BUG-692898: Low severity perl 5.30.0 vulnerability

Published Apr 1, 2011

Updated

A security flaw was found in the way Perl performed laundering of tainted data. A remote attacker could use this flaw to bypass Perl TAINT mode protection mechanism (leading to commands execution on dirty arguments or file system access via contaminated variables) via specially-crafted input provided to the web application / CGI script.

Upstream bug report: http://rt.perl.org/rt3/Public/Bug/Display.html?id=87336

Relevant patch: http://perl5.git.perl.org/perl.git/commitdiff/539689e74a3bcb04d29e4cd9396de91a81045b99

References: [1] https://bugzilla.redhat.com/showbug.cgi?id=692844

Affected Software

1 affected component

Perl Perl

Event History

Apr 1, 2011

Data Sourced

via Red Hat·02:39 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-692898?

The severity of REDHAT-BUG-692898 is considered critical due to the potential for remote code execution.

How do I fix REDHAT-BUG-692898?

To fix REDHAT-BUG-692898, update Perl to the latest version that includes the security patch addressing this vulnerability.

What systems are affected by REDHAT-BUG-692898?

REDHAT-BUG-692898 primarily affects systems running Perl that employ TAINT mode for data sanitation.

What can an attacker achieve with REDHAT-BUG-692898?

An attacker exploiting REDHAT-BUG-692898 could execute arbitrary commands or gain unauthorized file system access.

Is there a workaround for REDHAT-BUG-692898?

While updating Perl is the recommended solution, restricting input to trusted sources can serve as a temporary workaround for REDHAT-BUG-692898.