REDHAT-BUG-743010
First published: Mon Oct 03 2011(Updated: )
A flaw was reported [1] in perl Digest module's "Digest->new()" function, which did not properly sanitize input before using it in an eval() call, which could possibly be exploited to inject and execute arbitrary perl code. The flaw is fixed in version 1.17 [2] and affects at least as far back as perl 5.8.5. The following patch will correct the flaw (selectively taken from upstream's 1.16->1.17 differences): --- Digest.pm.org 2011-10-03 09:10:29.019681252 -0600 +++ Digest.pm 2011-10-03 09:11:18.630250656 -0600 @@ -35,7 +35,9 @@ sub new ($class, @args) = @$class if ref($class); no strict 'refs'; unless (exists ${"$class\::"}{"VERSION"}) { - eval "require $class"; + my $pm_file = $class . ".pm"; + $pm_file =~ s{::}{/}g; + eval { require $pm_file }; if ($@) { $err ||= $@; next; [1] <a href="https://secunia.com/advisories/46279/">https://secunia.com/advisories/46279/</a> [2] <a href="http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes">http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Perl Digest SHA | >=5.8.5<1.17 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://secunia.com/advisories/46279/
- http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=743058
- http://perldoc.perl.org/Digest.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=743010#c3
- https://rt.cpan.org/Public/Bug/Display.html?id=71390#txn-983600
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=526246&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=526246&action=edit
- https://rhn.redhat.com/errata/RHSA-2011-1424.html
- https://rhn.redhat.com/errata/RHSA-2011-1797.html
- https://bugzilla.redhat.com/show_bug.cgi?id=743010
Frequently Asked Questions
What is the severity of REDHAT-BUG-743010?
The severity of REDHAT-BUG-743010 is critical due to the potential for executing arbitrary Perl code.
How do I fix REDHAT-BUG-743010?
To fix REDHAT-BUG-743010, upgrade the Perl Digest module to version 1.17 or later.
Which versions of Perl Digest are affected by REDHAT-BUG-743010?
REDHAT-BUG-743010 affects Perl Digest module versions from 5.8.5 up to and including 1.16.
What is the main issue in REDHAT-BUG-743010?
The main issue in REDHAT-BUG-743010 is improper input sanitization in the Digest->new() function, leading to potential code injection.
Is there a known exploit for REDHAT-BUG-743010?
Yes, there is a potential exploit for REDHAT-BUG-743010 that could allow an attacker to inject and execute arbitrary Perl code.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-3597
- agent/references
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/perl
- canonical/perl digest sha