[Bug 1877427] New: perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

Bug ID: 1877427
           Summary: perl-dbi: Risk of memory corruption with many
                    arguments in DBI method dispatch
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Other

A flaw was foundin perl-dbi before version 1.632. Using many arguments to
methods for Callbacks may lead to memory corruption.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/a8b98e988d6ea2946f5f56691d6d5ead53f6...

[Bug 1877427] perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

Pedro Sampaio  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1857388

[Bug 1877427] perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

--- Comment #1 from Todd Cullum  ---
This may be related to BZ#1877402 per the upstream bug tracker [1] but I see
there was a separate patch issued in 1.632 listed in above comment.

1. https://rt.cpan.org/Public/Bug/Display.html?id=86744#txn-1880941

[Bug 1877427] perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

Todd Cullum  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1877963

[Bug 1877427] CVE-2013-7490 perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

Todd Cullum  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|perl-dbi: Risk of memory    |CVE-2013-7490 perl-dbi:
                   |corruption with many        |Risk of memory corruption
                   |arguments in DBI method     |with many arguments in DBI
                   |dispatch                    |method dispatch
              Alias|                            |CVE-2013-7490

[Bug 1877427] CVE-2013-7490 perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

--- Comment #4 from Todd Cullum  ---
Statement:

perl-DBI as shipped in Red Hat Enterprise Linux 8, rhscl-3 rh-perl526-perl-DBI
and rhscl-3 rh-perl530-perl-DBI are notaffected by this flaw as the vulnerable
code has already been patched in versions of perl-DBI shipped in these
products.

[Bug 1877427] CVE-2013-7490 perl-dbi: Risk of memory corruption with many arguments in DBI method dispatch

https://bugzilla.redhat.com/show_bug.cgi?id=1877427

Todd Cullum  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
        Last Closed|                            |2021-11-02 17:38:07