CVE-2011-3597

2012-01-1300:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.036

Percentile

91.6%

JSON

Eval injection vulnerability in the Digest module before 1.17 for Perl
allows context-dependent attackers to execute arbitrary commands via the
new constructor.

Bugs

Notes

Author	Note
mdeslaur	fixed in digest 1.17
jdstrand	from RedHat bug: "To successfully exploit this vulnerability, the attacker must already be able to execute Perl code or be able to set the algorithm name to be used by the constructor in the form "$ctx =
Digest-	new(XXX => $arg,…)“, which is very unlikely to happen.”

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchperl< 5.8.8-12ubuntu0.7UNKNOWN
ubuntu10.04noarchperl< 5.10.1-8ubuntu2.2UNKNOWN
ubuntu11.10noarchperl< 5.12.4-4ubuntu0.1UNKNOWN