Bug 385487 (CVE-2011-3597)

Summary:	<perl-core/digest-base-1.170.0 "Digest->new()" Code Injection Vulnerability (CVE-2011-3597)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	major	CC:	perl
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://secunia.com/advisories/46279/
Whiteboard:	B1 [glsa]
Package list:		Runtime testing required:	---
Bug Depends on:	458122
Bug Blocks:

Description Agostino Sarubbo gentoo-dev

2011-10-03 11:57:17 UTC

From secunia security advisory at $URL:

Description:
The vulnerability is caused due to the "Digest->new()" function not properly sanitising input before using it in an "eval()" call, which can be exploited to inject and execute arbitrary Perl code.

The vulnerability is reported in versions prior to 1.17.

Solution:
Update to version 1.17.

Comment 1 Sean Amoss (RETIRED) gentoo-dev

2012-01-14 17:44:05 UTC

@perl, can we proceed with stabilization of perl-core/digest-base-1.170.0? Thanks.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2012-02-21 03:57:20 UTC

CVE-2011-3597 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3597):
  Eval injection in the Digest module before 1.17 for Perl allows
  context-dependent attackers to execute arbitrary commands via the new
  constructor.

Comment 3 Mikle Kolyada (RETIRED) archtester

2013-08-18 13:28:43 UTC

It's already stabilized in bug 458122

Comment 4 Sergey Popov (RETIRED) gentoo-dev

2013-08-22 09:44:18 UTC

Thanks

New GLSA request filed

Comment 5 GLSAMaker/CVETool Bot gentoo-dev

2014-01-29 08:34:51 UTC

This issue was resolved and addressed in
 GLSA 201401-33 at http://security.gentoo.org/glsa/glsa-201401-33.xml
by GLSA coordinator Mikle Kolyada (Zlogene).