CVE-2011-3597

2012-01-1300:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.036 Low

EPSS

Percentile

91.5%

JSON

Eval injection vulnerability in the Digest module before 1.17 for Perl
allows context-dependent attackers to execute arbitrary commands via the
new constructor.

Bugs

Notes

Author	Note
mdeslaur	fixed in digest 1.17
jdstrand	from RedHat bug: "To successfully exploit this vulnerability, the attacker must already be able to execute Perl code or be able to set the algorithm name to be used by the constructor in the form "$ctx =
Digest-	new(XXX => $arg,…)“, which is very unlikely to happen.”

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchperl< 5.8.8-12ubuntu0.7UNKNOWN
ubuntu10.04noarchperl< 5.10.1-8ubuntu2.2UNKNOWN
ubuntu11.10noarchperl< 5.12.4-4ubuntu0.1UNKNOWN