REDHAT-BUG-884354: Medium severity Perl Locale::Maketext vulnerability
A commit to the upstream perl git repository [1] indicated that perl's Locale::Maketext was vulnerable to a flaw that could lead to arbitrary code execution of this function was executed on user-supplied input. Quoting the commit message:
Case 61251: This commit fixes a misparse of maketext strings that could lead to arbitrary code execution. Basically, maketext was compiling bracket notation into functions, but neglected to escape backslashes inside the content or die on fully-qualified method names when generating the code. This change escapes all such backslashes and dies when a method name with a colon or apostrophe is specified.
[1] http://perl5.git.perl.org/perl.git/commit/1735f6f53ca19f99c6e9e39496c486af323ba6a8
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
perlto a version that resolves this vulnerability.Patch 1735f6f53ca19f99c6e9e39496c486af323ba6a8
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-884354?
The severity of REDHAT-BUG-884354 is high due to the potential for arbitrary code execution.
How do I fix REDHAT-BUG-884354?
To fix REDHAT-BUG-884354, update the Perl Locale::Maketext module to the latest version that incorporates the security patch.
What are the potential impacts of REDHAT-BUG-884354?
The potential impacts of REDHAT-BUG-884354 include exploitation via user-supplied input leading to arbitrary code execution.
Which versions of Perl Locale::Maketext are affected by REDHAT-BUG-884354?
The affected versions of Perl Locale::Maketext are those prior to the patch that addresses the vulnerability indicated in REDHAT-BUG-884354.
Is my system vulnerable if I am using Perl Locale::Maketext before the patch associated with REDHAT-BUG-884354?
Yes, systems using Perl Locale::Maketext before the patch for REDHAT-BUG-884354 are vulnerable and should be updated.