PT-2012-1726 · Perl+1 · Digest+1

Vincent Danen · Published 2011-11-03 · Updated 2017-09-19 · CVE-2011-3597

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Digest module versions prior to 1.17

Description The issue allows context-dependent attackers to execute arbitrary commands via the new constructor. This is related to an eval injection vulnerability in the Digest module for Perl.

Recommendations For versions prior to 1.17, update to version 1.17 or later to resolve the issue. As a temporary workaround, consider restricting the use of the new constructor in the Digest module until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-3597

RHSA-2011:1424

RHSA-2011:1797

RHSA-2011_1424

RHSA-2011_1797

Affected Products

Digest

Red Hat

References · 28

• 🔥 https://exploit-db.com/exploits/36199 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-3597 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02611 · Security Note
• http://redhat.com/support/errata/RHSA-2011-1424.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-3597 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-3597 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2012:008 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2011-1797.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2011-3597 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=743010 · Patch
• http://ubuntu.com/usn/USN-1643-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-1424.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2012:009 · Vendor Advisory
• http://secunia.com/advisories/46279 · Vendor Advisory
• http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 · Note