Robert Rothenberg

**Name of the Vulnerable Software and Affected Versions** Imager versions prior to 1.033 **Description** Imager for Perl incorrectly treats unsigned EXIF IFD (Image File Directory) entry counts as signed. When processing large entry count values, the software interprets them as negative numbers, which can lead to an attempt to allocate a memory block nearly the size of the address space. This failure results in the termination of the worker process. An attacker can exploit this by providing a specially crafted image containing malicious EXIF data. **Recommendations** Update to version 1.033.

**Name of the Vulnerable Software and Affected Versions** DBI versions prior to 1.650 **Description** Code injection is possible via a caller-influenced `Profile` attribute. When a string is assigned to this attribute, the software splits it into path, package, and arguments, then interpolates the package part in a string eval without validating the package name. This allows arbitrary Perl code execution, including system command calls, if an attacker controls the `Profile` attribute. This attribute can be influenced through the `DBI PROFILE` environment variable, direct attribute assignment, or a DSN driver-attribute clause `dbi:Driver(Profile=>SPEC):db`. Network-exposed DBI::Gofer or DBI::ProxyServer instances are particularly susceptible if the per-request DSN reaches the `Profile` attribute, enabling remote code execution on the broker host. **Recommendations** Update to version 1.650 or later.

**Name of the Vulnerable Software and Affected Versions** DBI versions prior to 1.650 **Description** A heap overflow occurs when preparsing SQL statements that contain an extreme number of placeholders. This happens because insufficient memory was allocated to handle approximately 1.2 million placeholders. **Recommendations** Update to version 1.650 or later.

**Name of the Vulnerable Software and Affected Versions** Plack::Middleware::OAuth versions prior to 0.11 **Description** Plack::Middleware::OAuth for Perl fails to support the OAuth 2.0 state parameter. The `RequestTokenV2` function builds the provider authorization redirect without issuing a state value, and the `AccessTokenV2` function exchanges the callback code and registers the token into the session via `register session()` without verifying if the callback corresponds to an authorization request initiated by that session. This allows for login cross-site request forgery, where an attacker can force a victim's session to associate with the attacker's provider identity and access token. If the application persists this link, the attacker may maintain access to the victim's account. **Recommendations** Update Plack::Middleware::OAuth to version 0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Net::IP::LPM versions prior to 1.11 **Description** An issue exists where a heap out-of-bounds read can occur due to an unbounded prefix length. The `add()` function passes a prefix string to the `addPrefixToTrie()` function without verifying it against the address width. Consequently, `addPrefixToTrie()` reads past the end of the packed address buffer (4 bytes for IPv4 or 16 bytes for IPv6) when a prefix length exceeds 32 for IPv4 or 128 for IPv6. This read occurs during trie construction and is limited to a maximum of 32 bytes from the start of the packed address. While the out-of-bounds bytes are not exposed through the module API, the process may abort when using AddressSanitizer, valgrind, or a hardened allocator. **Recommendations** Update Net::IP::LPM to a version newer than 1.10.

**Name of the Vulnerable Software and Affected Versions** CGI::Session::ID::md5 versions prior to 4.49 **Description** Predictable session IDs are generated from low-entropy sources. The `generate id()` function creates the session ID using an MD5 digest of the process ID, the epoch time, and the built-in `rand()` function. These sources are considered low-entropy because the process ID is drawn from a small range, the epoch time can be guessed or retrieved from the HTTP Date header, and the `rand()` function is predictable and reversible. An attacker who predicts a session ID can impersonate a session and bypass authentication. **Recommendations** Update CGI::Session::ID::md5 to version 4.49 or later.

**Name of the Vulnerable Software and Affected Versions** CSS::Minifier::XS versions prior to 0.14 **Description** The `minify()` function contains a memory leak that occurs when processing a document consisting entirely of characters intended for removal, such as whitespace and comments, resulting in the entire document being minified away. **Recommendations** Update to version 0.14 or later.

**Name of the Vulnerable Software and Affected Versions** JavaScript::Minifier::XS versions prior to 0.16 **Description** A NULL pointer dereference occurs when the first meaningful token of the input is a slash. The issue resides in the `JsTokenizeString()` function within the `XS.xs` file, where the regexp versus division disambiguator fails to find a valid preceding token when a slash starts the input (or follows only whitespace and comments). This causes the process to read through a NULL contents pointer, leading to a crash. This can be triggered via the `minify()` API, allowing a remote attacker to cause a denial of service by sending a request containing a single slash byte to a service that minifies untrusted JavaScript. **Recommendations** Update to version 0.16 or later.

**Name of the Vulnerable Software and Affected Versions** Mojolicious::Plugin::Web::Auth::OAuth2 versions prior to 0.18 **Description** The module uses an insecure default state parameter when no state generator is specified in the constructor. It generates a SHA-1 hash using predictable, low-entropy sources, specifically the epoch time—which is exposed in the HTTP Date header—and the built-in Perl `rand` function. This predictability enables an attacker to perform cross site request forgery (CSRF), a technique used to trick a user into executing unwanted actions on a web application, potentially leading to session hijacking. **Recommendations** Update to a version newer than 0.17. As a temporary mitigation, specify a secure state generator in the constructor instead of relying on the default setting.

**Name of the Vulnerable Software and Affected Versions** Crypt::PBKDF2 versions prior to 0.261630 **Description** The software uses a weak default algorithm and an insufficient number of iterations. The default algorithm is HMAC-SHA1, which is intended only for legacy systems. Additionally, the default configuration uses 1000 iterations, whereas 220,000 to 1,400,000 iterations are recommended depending on the selected algorithm. **Recommendations** Update to version 0.261630 or later.

**Name of the Vulnerable Software and Affected Versions** Net::CIDR::Set versions prior to 0.21 **Description** The software fails to validate IP addresses. The `add()` function calls the ` encode()` function to parse addresses; if the input does not resemble netmasks or network ranges, it is treated as a single IP address and passed back to itself as a 32-bit or 128-bit netmask. When a malformed IP address is provided, this process results in indefinite recursion, which can be exploited by an attacker to cause a denial of service. **Recommendations** Update to version 0.21.

**Name of the Vulnerable Software and Affected Versions** Crypt::ScryptKDF versions prior to 0.011 **Description** The software uses an insecure random number source when no Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) module is available. Specifically, the `random bytes()` function falls back to the built-in `rand()` function if the modules `Crypt::PRNG`, `Crypt::OpenSSL::Random`, `Net::SSLeay`, `Crypt::Random`, or `Bytes::Random::Secure` are not present. **Recommendations** Update to a version later than 0.010.

**Name of the Vulnerable Software and Affected Versions** Mojolicious::Plugin::Statsd versions prior to 0.06 **Description** This issue allows metric injections when processing data from untrusted sources. The software fails to validate metric names and set values for the presence of newlines, colons, or pipes, which can be used to inject additional statsd metrics. **Recommendations** Update Mojolicious::Plugin::Statsd to version 0.06 or later.

**Name of the Vulnerable Software and Affected Versions** Crypt::SaltedHash versions prior to 0.10 **Description** Crypt::SaltedHash for Perl generates insecure random values for salts because it utilizes the built-in `rand()` function, which is predictable and unsuitable for cryptographic purposes. **Recommendations** Update to a version later than 0.09.

**Name of the Vulnerable Software and Affected Versions** Crypt::SaltedHash versions prior to 0.110.0 **Description** Crypt::SaltedHash for Perl is susceptible to timing attacks because it uses Perl's built-in `eq` comparison. Discrepancies in timing could be used to guess the underlying hash. **Recommendations** Update to version 0.110.0.

**Name of the Vulnerable Software and Affected Versions** Template::Plugin::HTML versions prior to 3.103 **Description** Template::Plugin::HTML for Perl allows the injection of HTML and JavaScript. The `html filter()` function fails to escape single quotes, which enables code injection within HTML attributes enclosed in single quotes. For instance, a variable like `var` used in `<a id='ref' title='[% var | html %]'>` is not properly escaped. An attacker could provide a value such as ` ' onclick='while (true) { alert(1) }'` to execute scripts. The ability to inject arbitrary HTML and JavaScript is limited because angle brackets, ampersands, and double quotes remain escaped. **Recommendations** Update to a version later than 3.102. As a temporary workaround, avoid using single quotes for HTML attributes when utilizing the `html filter()` function.

**Name of the Vulnerable Software and Affected Versions** Web::Passwd version 0.03 **Description** Web::Passwd, a small CGI application for managing htpasswd files via the htpasswd command, allows remote code execution. The `user` parameter is not validated or escaped before being used as the final argument on the command line, which enables command injection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Amazon::Credentials versions prior to 1.3.0 **Description** Amazon::Credentials stores credentials in an obfuscated form to prevent secrets from being accessed via a data dump of the object. The software uses a 64-bit key generated by the built-in `rand` function to encrypt these secrets. The `rand` function is predictable and unsuitable for cryptographic purposes. **Recommendations** Update to version 1.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** Crypt::PasswdMD5 versions prior to 1.43 **Description** The software generates insecure random values for salts because the built-in `rand()` function is predictable and unsuitable for cryptographic purposes. **Recommendations** Update to a version later than 1.42.

**Name of the Vulnerable Software and Affected Versions** Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 **Description** Apache::Session::Generate::ModUniqueId uses the `UNIQUE ID` environment variable for session identifiers. This variable is generated by the Apache mod unique id plugin using the IPv4 address, process ID, epoch time, a 16-bit counter, and a thread index without obfuscation. Because the server IP, process IDs, and timestamps are often public or predictable, these session identifiers are insecure and unsuitable for security purposes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.