PT-2021-4681 · Perl+2 · Perl+2

Dom Hargreaves + 1 · Published 2021-08-09 · Updated 2024-08-28 · CVE-2021-36770

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Encode.pm versions 3.05 through 3.11 Perl versions through 5.34.0

Description The issue is related to incorrect path handling in the Encode.pm module of the Perl programming language. This allows an attacker to inject arbitrary code and gain privileges. The exploitation requires an unusual configuration. The problem occurs because the || operator evaluates @INC in a scalar context, resulting in @INC having only an integer value.

Recommendations For Encode.pm versions 3.05 through 3.11, consider disabling the Encode::ConfigLocal library as a temporary workaround until a patch is available. For Perl versions through 5.34.0, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

BDU:2021-05374

CVE-2021-36770

MGASA-2021-0527

OESA-2022-1549

ROSA-SA-2024-2471

USN-5033-1

Affected Products

Encode.Pm

Perl

Ubuntu

References · 32

• https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9 · Patch
• https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74 · Patch
• https://cve.org/CVERecord?id=CVE-2021-36770 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36770 · Security Note
• https://bdu.fstec.ru/vul/2021-05374 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/6KOZYD7BH2DNIAEZ2ZL4PJ4QUVQI6Y33 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1549 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36770 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36770 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-36770 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0527 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-36770 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-36770 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-36 · Vendor Advisory