[Bug 1877437] New: perl-dbi: Externally controlled format string in Perl_croak function

https://bugzilla.redhat.com/show_bug.cgi?id=1877437

            Bug ID: 1877437
           Summary: perl-dbi: Externally controlled format string in
                    Perl_croak function
           Product: Security Response
          Hardware: All
                OS: Linux
            Status: NEW
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team(a)redhat.com
          Reporter: psampaio(a)redhat.com
                CC: caillon+fedoraproject(a)gmail.com, hhorak(a)redhat.com,
                    john.j5live(a)gmail.com, jorton(a)redhat.com,
                    jplesnik(a)redhat.com, kasal(a)ucw.cz,
                    perl-devel(a)lists.fedoraproject.org,
                    perl-maint-list(a)redhat.com, ppisar(a)redhat.com,
                    rhughes(a)redhat.com, rstrode(a)redhat.com,
                    sandmann(a)redhat.com
  Target Milestone: ---
    Classification: Other



A flaw was found in perl-dbi before version 1.637. Arbitrary string supplied by
caller can be passed into Perl_croak function which expects
printf-style arguments. Malicious remote systems via specially crafted error
messages can cause problems like buffer overflow or overwriting other part of
process memory.

References:

https://www.mail-archive.com/[e-mail]/msg35486.html
https://rt-archive.perl.org/perl5/Ticket/Display.html?id=131878
https://github.com/perl/perl5/issues/16108


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877437] perl-dbi: Externally controlled format string in Perl_croak function

https://bugzilla.redhat.com/show_bug.cgi?id=1877437

Pedro Sampaio <psampaio(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |1857388




-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877437] perl-dbi: Externally controlled format string in Perl_croak function

https://bugzilla.redhat.com/show_bug.cgi?id=1877437



--- Comment #1 from Todd Cullum <tcullum(a)redhat.com&gt; ---
Upstream commit:
https://github.com/perl5-dbi/dbi/pull/44/commits/c6d410d1bafa6876e6a346a2...


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877437] perl-dbi: Externally controlled format string in Perl_croak function

https://bugzilla.redhat.com/show_bug.cgi?id=1877437



--- Comment #2 from Todd Cullum <tcullum(a)redhat.com&gt; ---
Statement:

Versions of perl-DBI shipped with Red Hat Enterprise Linux 7 and 8 are not
affected by this flaw because the vulnerable code was not yet committed in
v1.627 shipped with Red Hat Enterprise Linux 7, and already patched in version
1.642 shipped with Red Hat Enterprise Linux 8. This also applies to perl-DBI as
part of Red Hat Software Collections 3. Thus, none of these products are
affected.


-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1877437] perl-dbi: Externally controlled format string in Perl_croak function

https://bugzilla.redhat.com/show_bug.cgi?id=1877437

Product Security DevOps Team <prodsec-dev(a)redhat.com&gt; changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|---                         |WONTFIX
        Last Closed|                            |2020-09-10 01:17:48




-- 
You are receiving this mail because:
You are on the CC list for the bug.