PT-2020-3691 · Perl+9 · Perl+9
Published
2020-06-01
·
Updated
2026-03-10
·
CVE-2020-10878
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:C |
Name of the Vulnerable Software and Affected Versions
Perl versions prior to 5.30.3
Description
The issue is related to an integer overflow in Perl, specifically when handling a situation where "PL regkind[OP(n)] == NOTHING". This can be triggered by a crafted regular expression, potentially leading to malformed bytecode and a possibility of instruction injection. An application written in Perl is only vulnerable if it evaluates regular expressions supplied by an attacker. Evaluating regular expressions in this manner is known to be dangerous, as the regular expression engine does not protect against denial of service attacks in this scenario.
Recommendations
For Perl versions prior to 5.30.3, update to version 5.30.3 or later to resolve the issue. As a temporary workaround, consider avoiding the evaluation of regular expressions supplied by attackers, or restrict the use of the vulnerable regular expression engine to minimize the risk of exploitation.
Fix
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Ibm Aix
Linuxmint
Perl
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu