PT-2020-3690 · Perl+8 · Perl+8
Published
2020-06-01
·
Updated
2024-06-15
·
CVE-2020-10543
CVSS v2.0
8.5
High
| Vector | AV:N/AC:L/Au:N/C:N/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
Perl versions prior to 5.30.3
Description
The issue is related to a heap-based buffer overflow in Perl due to an integer overflow caused by nested regular expression quantifiers. This can be exploited if an application written in Perl evaluates regular expressions supplied by an attacker, which is a known dangerous practice as the regular expression engine does not protect against denial of service attacks in this scenario. The target system needs sufficient memory to allocate partial expansions of the nested quantifiers before the overflow occurs, a condition unlikely to be met on 64-bit systems.
Recommendations
For versions prior to 5.30.3, update to version 5.30.3 or later to resolve the issue. As a temporary workaround, consider avoiding the evaluation of regular expressions supplied by attackers to minimize the risk of exploitation. Restricting the amount of memory available for partial expansions of nested quantifiers can also help mitigate the risk, although this may not be feasible in all scenarios.
Fix
Memory Corruption
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Ibm Aix
Linuxmint
Perl
Red Hat
Rocky Linux
Suse
Ubuntu