New CVEs and security fix releases for perl

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
New CVEs and security fix releases for perl

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Alan Coopersmith &lt;alan.coopersmith () oracle com&gt;

Date: Thu, 30 Nov 2023 16:42:04 -0800

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
[While https://github.com/Perl/perl5/blob/blead/pod/perlsecpolicy.pod states
 they will send security advisories to this list, I haven't seen any come
 through yet for these issues.  -alan-]

https://metacpan.org/release/PEVANS/perl-5.38.1/view/pod/perldelta.pod lists
two new CVE's:

--------------------------------------------------------------------------------
CVE-2023-47038 - Write past buffer end via illegal user-defined Unicode property

This vulnerability was reported directly to the Perl security team by
Nathan Mills the.true.nathan.mills () gmail com.

A crafted regular expression when compiled by perl 5.30.0 through 5.38.0 can
cause a one-byte attacker controlled buffer overflow in a heap allocated buffer.
--------------------------------------------------------------------------------
CVE-2023-47039 - Perl for Windows binary hijacking vulnerability

This vulnerability was reported to the Intel Product Security Incident Response
Team (PSIRT) by GitHub user ycdxsb
https://github.com/ycdxsb/WindowsPrivilegeEscalation.
PSIRT then reported it to the Perl security team.

Perl for Windows relies on the system path environment variable to find the
shell (cmd.exe). When running an executable which uses Windows Perl interpreter,
Perl attempts to find and execute cmd.exe within the operating system. However,
due to path search order issues, Perl initially looks for cmd.exe in the current
working directory.

An attacker with limited privileges can exploit this behavior by placing cmd.exe
in locations with weak permissions, such as C:\ProgramData. By doing so, when an
administrator attempts to use this executable from these compromised locations,
arbitrary code can be executed.
--------------------------------------------------------------------------------

The 5.34.2, 5.36.2 and 5.38.1 releases were issued with fixes for these issues.
However, there were issues with those releases, as noted in the email at
https://www.nntp.perl.org/group/perl.perl5.porters/2023/11/msg267365.html
and thus versions 5.34.3, 5.36.3 and 5.38.2 were released to fix those issues:
https://www.nntp.perl.org/group/perl.perl5.porters/2023/11/msg267400.html

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

New CVEs and security fix releases for perl Alan Coopersmith (Nov 30)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->