[Bug 1877405] New: perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Bug ID: 1877405
           Summary: perl-dbi: NULL profile dereference in dbi_profile()
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: low
          Priority: low
          Assignee: [e-mail]
          Reporter: [e-mail]
                CC: [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail],
                    [e-mail], [e-mail],
                    [e-mail], [e-mail],
                    [e-mail]
  Target Milestone: ---
    Classification: Other

A flaw was found in perl-dbi. hv_fetch() documentation requires checking for
NULL and the code does that. But then calls SvOK(profile) uncoditionally two
lines later lead to a null profile dereference.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc...

[Bug 1877405] perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Pedro Sampaio  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1877406

Referenced Bugs:

https://bugzilla.redhat.com/show_bug.cgi?id=1877406
[Bug 1877406] perl-DBI: NULL profile dereference in dbi_profile() [fedora-all]

[Bug 1877405] perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

--- Comment #1 from Pedro Sampaio  ---
Created perl-DBI tracking bugs for this issue:

Affects: fedora-all [bug 1877406]

[Bug 1877405] perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Pedro Sampaio  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Comment|0                           |updated

--- Comment #0 has been edited ---

A flaw was found in perl-dbi. hv_fetch() documentation requires checking for
NULL and the code does that. But then calls SvOK(profile) uncoditionally two
lines later lead to a null profile dereference.

Upstream patch:

https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc...

[Bug 1877405] perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Pedro Sampaio  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1857388

[Bug 1877405] perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Todd Cullum  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends On|                            |1877512, 1877511, 1877514,
                   |                            |1877513

[Bug 1877405] CVE-2019-20919 perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Todd Cullum  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|perl-dbi: NULL profile      |CVE-2019-20919 perl-dbi:
                   |dereference in              |NULL profile dereference in
                   |dbi_profile()               |dbi_profile()
              Alias|                            |CVE-2019-20919

[Bug 1877405] CVE-2019-20919 perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405
Bug 1877405 depends on bug 1877406, which changed state.

Bug 1877406 Summary: CVE-2019-20919 perl-DBI: NULL profile dereference in dbi_profile() [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1877406

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ON_QA                       |CLOSED
         Resolution|---                         |ERRATA

[Bug 1877405] CVE-2019-20919 perl-dbi: NULL profile dereference in dbi_profile()

https://bugzilla.redhat.com/show_bug.cgi?id=1877405

Todd Cullum  changed:

What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
        Last Closed|                            |2021-11-02 17:26:15