oss-sec mailing list archives
New CVEs and security fix releases for perl
From: Alan Coopersmith <alan.coopersmith () oracle com>
Date: Thu, 30 Nov 2023 16:42:04 -0800
[While https://github.com/Perl/perl5/blob/blead/pod/perlsecpolicy.pod states they will send security advisories to this list, I haven't seen any come through yet for these issues. -alan-] https://metacpan.org/release/PEVANS/perl-5.38.1/view/pod/perldelta.pod lists two new CVE's: -------------------------------------------------------------------------------- CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property This vulnerability was reported directly to the Perl security team by Nathan Mills the.true.nathan.mills () gmail com. A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can cause a one-byte attacker controlled buffer overflow in a heap allocated buffer. -------------------------------------------------------------------------------- CVE-2023-47039 - Perl for Windows binary hijacking vulnerability This vulnerability was reported to the Intel Product Security Incident Response Team (PSIRT) by GitHub user ycdxsb https://github.com/ycdxsb/WindowsPrivilegeEscalation. PSIRT then reported it to the Perl security team. Perl for Windows relies on the system path environment variable to find the shell (cmd.exe). When running an executable which uses Windows Perl interpreter, Perl attempts to find and execute cmd.exe within the operating system. However, due to path search order issues, Perl initially looks for cmd.exe in the current working directory. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData. By doing so, when an administrator attempts to use this executable from these compromised locations, arbitrary code can be executed. -------------------------------------------------------------------------------- The 5.34.2, 5.36.2 and 5.38.1 releases were issued with fixes for these issues. However, there were issues with those releases, as noted in the email at https://www.nntp.perl.org/group/perl.perl5.porters/2023/11/msg267365.html and thus versions 5.34.3, 5.36.3 and 5.38.2 were released to fix those issues: https://www.nntp.perl.org/group/perl.perl5.porters/2023/11/msg267400.html -- -Alan Coopersmith- alan.coopersmith () oracle com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
Current thread:
- New CVEs and security fix releases for perl Alan Coopersmith (Nov 30)