PT-2026-33993 · Storable · Storable

Published 2026-04-21 · Updated 2026-04-28 · CVE-2017-20230

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Storable versions prior to 3.05

Description A stack overflow exists in the retrieve hook() function. The issue occurs because the length of the class name is stored as a signed integer but is treated as unsigned during read operations, allowing an attacker to craft data that triggers the overflow.

Recommendations Update to version 3.05.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2017-20230

RHSA-2026:7578

SUSE-SU-2026:1567-1

Affected Products

Storable

References · 20

• https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch · Patch
• https://ubuntu.com/security/CVE-2017-20230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-20230 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-20230 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-20230 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-20230 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-20230 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1567-1 · Vendor Advisory
• https://github.com/Perl/perl5/issues/15831 · Note
• https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216 · Note
• https://twitter.com/ctiwatchcloud/status/2046921975730262063 · Twitter Post
• https://lists.security.metacpan.org/cve-announce/msg/39144694 · Note
• http://openwall.com/lists/oss-security/2026/04/21/5 · Note
• https://bugzilla.suse.com/1262486 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20261567-1 · Note