NULL pointer dereference in DBI - CVE-2019-20919

Vulnerability identifier: #VU46868

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-20919

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error in the DBI module before 1.643 for Perl. The hv_fetch() documentation requires checking for NULL and the code does that. But, shortly thereafter, it calls SvOK(profile), causing a NULL pointer dereference. A remote attacker can perform a denial of service (DoS) attack.

DBI
Ubuntu
Opensuse
openEuler
Fedora
libdbi-perl (Ubuntu package)
perl-DBI
perl-DBI-help
perl-DBI-debugsource
perl-DBI-debuginfo

Update to version 1.643.

DBI - update to 1.643
libdbi-perl (Ubuntu package) - addressed in versions 1.616-1ubuntu0.2, 1.630-1ubuntu0.1~esm4, 1.634-1ubuntu0.2, 1.640-1ubuntu0.2
perl-DBI - update to 1.643-1
perl-DBI-help - update to 1.643-1
perl-DBI-debugsource - update to 1.643-1
perl-DBI-debuginfo - update to 1.643-1
perl-DBI - update to 1.643-3.fc31

• https://github.com/perl5-dbi/dbi/commit/eca7d7c8f43d96f6277e86d1000e842eb4cc67ff
• https://metacpan.org/pod/distribution/DBI/Changes#Changes-in-DBI-1.643-...

• NULL pointer dereference in Perl DBI module
• OpenSUSE Linux update for perl-DBI
• OpenSUSE Linux update for perl-DBI
• openEuler 20.03 LTS update for perl-DBI
• Ubuntu update for libdbi-perl
• Fedora 31 update for perl-DBI