develooper Front page | perl.perl5.porters | Postings from August 2021

[Encode] 3.12 Released, update NOW to address CVE-2021-36770

Thread Previous | Thread Next
Dan Kogai
August 9, 2021 14:36
[Encode] 3.12 Released, update NOW to address CVE-2021-36770
Message ID:

Encode 3.12 is released to address the issue below which is a SECURITY FIX. UPDATE NOW.

> On Aug 9, 2021, at 21:27, Ricardo Signes <> wrote:
> Porters,
> I have attached a fix for a bug in Encode, registered as CVE-2021-36770.  This bug replaces the contents of @INC with a predictable integer, which is treated as a directory relative to the current working directory, long enough to execute one "require".
> The vulnerability was introduced in Encode v3.05, here: dankogai/p5-encode@9c5f5a3  It was shipped with perl v5.32 and v5.34.
> A simple proof of concept:
> dinah:~/tmp$ perl -MEncode -e0
> dinah:~/tmp$ perl -E 'say scalar @INC'
> 4
> dinah:~/tmp$ mkdir -p 4/Encode
> dinah:~/tmp$ echo 'print "Something evil here!!\n"' > 4/Encode/
> dinah:~/tmp$ perl -MEncode -e0
> Something evil here!!
> A new release of Encode should be available from the CPAN today, and will be swiftly integrated into perl5.git.  I expect this fix will shortly be available from major distributors of perl.  In the meantime, I have applied a patch to the repository.
> This bug was reported to perlsec on June 26 by Dom Hargreaves on behalf of Debian, passing on a report from Paul Wise.
> --
> rjbs
> <0001-mitigate-INC-pollution-when-loading-ConfigLocal.patch>

head1 Availability

* git clone git://
* CPAN near you.

Travis is all green.


=head1 CPAN index

 User: DANKOGAI ()
 Distribution file: Encode-3.12.tar.gz
 Number of files: 225
 *.pm files: 26
 README: Encode-3.12/README
 META-File: Encode-3.12/META.json
 META-Parser: Parse::CPAN::Meta 1.4414
 META-driven index: no
 Timestamp of file: Mon Aug  9 14:30:33 2021 UTC
 Time of this run: Mon Aug  9 14:33:28 2021 UTC

=head1 Changes

$Revision: 3.12 $ $Date: 2021/08/09 14:17:04 $
  Address CVE-2021-36770

=head1 AUTHOR

Dan the Encode Maintainer

Thread Previous | Thread Next Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at | Group listing | About