PlRPC is a Perl module that implements IDL-free RPCs. It is intended for cross-domain applications, but it fails to achieve that goal because it uses Storable, which is known to be insecure when deserializing (thawing) untrusted data. User name and password are transmitted using Storable, so code execution can happen before authentication.

The patches that exist just document the issues and are not real fixes.

References: http://seclists.org/oss-sec/2014/q1/56 https://rt.cpan.org/Public/Bug/Display.html?id=90474

Commit/Patch: http://pkgs.fedoraproject.org/cgit/perl-PlRPC.git/commit/?id=b9497b8d780a54ff5be6661c5f24d70135e0bb79