Bug 385487 – <perl-core/digest-base-1.170.0 "Digest->new()" Code Injection Vulnerability (CVE-2011-3597)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2011-10-03 11:57:17 UTC]

From secunia security advisory at $URL:

Description:
The vulnerability is caused due to the "Digest->new()" function not properly sanitising input before using it in an "eval()" call, which can be exploited to inject and execute arbitrary Perl code.

The vulnerability is reported in versions prior to 1.17.

Solution:
Update to version 1.17.

[Comment 1 Sean Amoss (RETIRED) 2012-01-14 17:44:05 UTC]

@perl, can we proceed with stabilization of perl-core/digest-base-1.170.0? Thanks.

[Comment 2 GLSAMaker/CVETool Bot 2012-02-21 03:57:20 UTC]

CVE-2011-3597 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3597):
  Eval injection in the Digest module before 1.17 for Perl allows
  context-dependent attackers to execute arbitrary commands via the new
  constructor.

[Comment 3 Mikle Kolyada (RETIRED) 2013-08-18 13:28:43 UTC]

It's already stabilized in bug 458122

[Comment 4 Sergey Popov (RETIRED) 2013-08-22 09:44:18 UTC]

Thanks

New GLSA request filed

[Comment 5 GLSAMaker/CVETool Bot 2014-01-29 08:34:51 UTC]

This issue was resolved and addressed in
 GLSA 201401-33 at http://security.gentoo.org/glsa/glsa-201401-33.xml
by GLSA coordinator Mikle Kolyada (Zlogene).