develooper Front page | perl.perl5.porters | Postings from August 2021

[Encode] 3.12 Released, update NOW to address CVE-2021-36770

Thread Previous | Thread Next
From:
Dan Kogai
Date:
August 9, 2021 14:36
Subject:
[Encode] 3.12 Released, update NOW to address CVE-2021-36770
Message ID:
1477DD93-71EB-4DF9-9FBB-3DCF86FBB76B@dan.co.jp
Porters,

Encode 3.12 is released to address the issue below which is a SECURITY FIX. UPDATE NOW.

> On Aug 9, 2021, at 21:27, Ricardo Signes <perl.p5p@rjbs.manxome.org> wrote:
> 
> Porters,
> 
> I have attached a fix for a bug in Encode, registered as CVE-2021-36770.  This bug replaces the contents of @INC with a predictable integer, which is treated as a directory relative to the current working directory, long enough to execute one "require".
> 
> The vulnerability was introduced in Encode v3.05, here: dankogai/p5-encode@9c5f5a3  It was shipped with perl v5.32 and v5.34.
> 
> A simple proof of concept:
> 
> dinah:~/tmp$ perl -MEncode -e0
> dinah:~/tmp$ perl -E 'say scalar @INC'
> 4
> dinah:~/tmp$ mkdir -p 4/Encode
> dinah:~/tmp$ echo 'print "Something evil here!!\n"' > 4/Encode/ConfigLocal.pm
> dinah:~/tmp$ perl -MEncode -e0
> Something evil here!!
> 
> 
> A new release of Encode should be available from the CPAN today, and will be swiftly integrated into perl5.git.  I expect this fix will shortly be available from major distributors of perl.  In the meantime, I have applied a patch to the repository.
> 
> This bug was reported to perlsec on June 26 by Dom Hargreaves on behalf of Debian, passing on a report from Paul Wise.
> 
> --
> rjbs
> <0001-mitigate-INC-pollution-when-loading-ConfigLocal.patch>

head1 Availability

* git clone git://github.com/dankogai/p5-encode.git
* https://www.dan.co.jp/~dankogai/cpan/Encode-3.12.tar.gz
* CPAN near you.

Travis is all green.

* https://travis-ci.org/dankogai/p5-encode

=head1 CPAN index

 User: DANKOGAI ()
 Distribution file: Encode-3.12.tar.gz
 Number of files: 225
 *.pm files: 26
 README: Encode-3.12/README
 META-File: Encode-3.12/META.json
 META-Parser: Parse::CPAN::Meta 1.4414
 META-driven index: no
 Timestamp of file: Mon Aug  9 14:30:33 2021 UTC
 Time of this run: Mon Aug  9 14:33:28 2021 UTC

=head1 Changes

$Revision: 3.12 $ $Date: 2021/08/09 14:17:04 $
! Encode.pm
  Address CVE-2021-36770
  <9639159a-d070-4762-9cbd-f1622f10449c@beta.fastmail.com>

=head1 AUTHOR

Dan the Encode Maintainer

Thread Previous | Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About