Stig Palmquist

**Name of the Vulnerable Software and Affected Versions** IO::Uncompress::Unzip versions prior to 2.220 **Description** An issue in the `fastForward()` function allows CPU exhaustion. The function compares the length of the `$offset` variable (the digit count of the offset, ranging from 1 to 19) against the chunk size `$c` instead of comparing the `$offset` value itself. This causes the chunk size `$c` to shrink from 16 KiB to between 1 and 19 bytes per iteration. An attacker can trigger a per-byte read loop that scales with the compressed size of an entry, up to the 4 GiB non-Zip64 limit, by extracting a named entry from a malicious zip file using `IO::Uncompress::Unzip->new($zip, Name => $target)`. **Recommendations** Update to version 2.220 or later.

**Name of the Vulnerable Software and Affected Versions** HTTP::Daemon versions prior to 6.17 **Description** OS command injection is possible through the `send file()` function. This occurs because `send file()` utilizes Perl's 2-arg open() function, which interprets magic prefixes. Specifically, prefixes like '| cmd' and 'cmd |' open a pipe to a subprocess, while '> path' and '>> path' open a path for writing or appending. If untrusted input is passed to `send file()`, OS commands can be executed with the daemon process UID. Additionally, the read-pipe form ('cmd |') can leak subprocess stdout into the HTTP response body, and write-mode forms can create or truncate files at paths chosen by an attacker. **Recommendations** Update to version 6.17 or later. As a temporary workaround, restrict or avoid passing untrusted input to the `send file()` function.

**Name of the Vulnerable Software and Affected Versions** IO::Compress versions 2.207 through 2.219 **Description** The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field (tag 0x7875) where the UID Size or GID Size is set to 8. This occurs because the `decode ux()` function triggers `decodeLitteEndian()`, which attempts to call a misnamed helper function `unpackValueQ`. Since the actual function is defined as `unpackValue Q`, the script fails with an undefined subroutine error and exits. Library callers of IO::Compress and IO::Uncompress are not affected. **Recommendations** Update to version 2.220.

**Name of the Vulnerable Software and Affected Versions** Archive::Tar versions prior to 3.10 **Description** Archive::Tar for Perl allows memory exhaustion when processing a tar header with an attacker-controlled entry size field. The ` read tar()` function reads each entry's payload using `$handle->read($$data, $block)`, where the `$block` variable is derived from the 12-byte size field in the tar header without an upper bound. A crafted header specifying a multi-gigabyte size forces Perl to allocate a scalar of that size, leading to memory exhaustion. **Recommendations** Update to version 3.10 or later.

**Name of the Vulnerable Software and Affected Versions** Archive::Tar versions prior to 3.08 **Description** Archive::Tar for Perl allows the extraction of hardlinks to attacker-controlled paths outside the intended extraction directory. The function ` make special file()` passes the tar header's linkname to `link()` without validating it against absolute paths or `..` segments, which creates a hardlink sharing the victim file's inode. A subsequent write through the extracted name modifies the victim file. Additionally, the post-extraction chmod, chown, and utime block in ` extract file()` applies the tar header's mode, owner, and timestamps to the shared inode during extraction, as it is only guarded against symlinks via `-l`. **Recommendations** Update to version 3.08 or later.

**Name of the Vulnerable Software and Affected Versions** Archive::Tar versions prior to 3.08 **Description** Archive::Tar for Perl allows the extraction of symlinks with attacker-controlled targets located outside the extraction directory. The function ` make special file()` passes the tar header's linkname to `symlink()` without validating it against absolute paths or `..` segments. While a secure-extract mode exists to guard regular file extraction, it does not cover the symlink target. Consequently, a subsequent open operation through the extracted name can read or write to an attacker-chosen path. **Recommendations** Update Archive::Tar to version 3.08 or later.

**Name of the Vulnerable Software and Affected Versions** WebDyne::Session versions prior to 2.076 **Description** The session handler generates session identifiers insecurely using an MD5 hash seeded with the built-in `rand()` function. The `rand()` function is seeded by 32-bits, making it predictable and unsuitable for cryptographic purposes. This predictability could allow an attacker to gain unauthorized access to systems. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** App::cpanminus versions 1.7047 and earlier **Description** The App::cpanminus package for Perl downloads code via insecure HTTP, enabling code execution for network attackers. This issue allows attackers to intercept traffic. **Recommendations** For App::cpanminus versions 1.7047 and earlier, consider disabling the use of insecure HTTP downloads until a patch is available. As a temporary workaround, restrict access to the module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GitLab::API::v4 versions 0.26 and earlier **Description** The issue allows for machine-in-the-middle attacks due to the lack of TLS certificate verification when connecting to a GitLab server. **Recommendations** For GitLab::API::v4 versions 0.26 and earlier, update to a version that verifies TLS certificates to prevent machine-in-the-middle attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPAN.pm versions prior to 2.35 **Description** The issue is related to errors in the TLS certificate authentication procedure, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem stems from the failure to verify TLS certificates when downloading distributions over HTTPS. This can lead to a man-in-the-middle attack, where an attacker could gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system. **Recommendations** For versions prior to 2.35, update to version 2.35 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS for distribution downloads until a patch is available. Restrict access to sensitive information and communication channels to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** App::cpanminus version 1.7044 **Description** The issue allows Signature Verification Bypass. **Recommendations** For version 1.7044, update to a version that fixes the Signature Verification Bypass issue.

**Name of the Vulnerable Software and Affected Versions** CPAN::Checksums version 2.12 **Description** The issue concerns the CPAN::Checksums package for Perl, which does not uniquely define signed data. This could potentially lead to security issues, although specific details about exploitation or affected devices are not provided. **Recommendations** For CPAN::Checksums version 2.12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPAN version 2.28 **Description** The issue is related to the incorrect verification of cryptographic signatures in the CPAN language, specifically in the `Module::Signature:: verify()` function. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For CPAN version 2.28, consider disabling the `Module::Signature:: verify()` function as a temporary workaround until a patch is available. Restrict access to sensitive data and modules that rely on cryptographic signature verification to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Digi TransPort LR54 version 4.4.0.26 and possible earlier versions Description: The issue is related to Improper Input Validation, allowing users with 'super' CLI access privileges to bypass a restricted shell and execute arbitrary commands as root. Recommendations: For version 4.4.0.26 and possible earlier versions, restrict `super` CLI access privileges to prevent bypassing of the restricted shell until a fix is available. Consider limiting the execution of arbitrary commands as root to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** python-gnupg version 0.4.3 **Description** The issue is related to improper input validation, allowing context-dependent attackers to trick gnupg into decrypting other ciphertext than intended. This can be achieved if the passphrase to gnupg is controlled by the adversary and the ciphertext is trusted. The vulnerability exists due to insufficient input validation in the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods of the python-gnupg package, which may allow an attacker to execute arbitrary code. **Recommendations** For python-gnupg version 0.4.3, consider restricting the use of the `gnupg.GPG.encrypt()` and `gnupg.GPG.decrypt()` methods until a patch is available. Additionally, ensure that the passphrase to gnupg is securely managed and that only trusted ciphertext is processed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HTTP-Body module for Perl versions 1.07 through 1.22 **Description** The issue allows remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix of a temporary file is well-formed. This is because the `HTTP::Body::Multipart` function uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file. **Recommendations** For versions 1.07 through 1.22, update to version 1.23 or later to resolve the issue.