Insecure library loading in p5-encode - CVE-2021-36770

Vulnerability identifier: #VU55804

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-36770

CWE-ID: CWE-427

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a logic error in the Encode.pm script. A local user can place a malicious library into the current working directory and escalate privileges on the system.

p5-encode
Gentoo Linux
openEuler
Ubuntu
Fedora
Perl
cPanel
Oracle Middleware Common Libraries and Tools
Middleware Common Libraries and Tools
Autodesk Infraworks
Oracle Enterprise Manager for Fusion Middleware
perl-Encode-help
perl-Encode-debuginfo
perl-Encode
perl-Encode-devel
perl-Encode-debugsource
perl (Ubuntu package)
perl-bootstrap
perl
dev-lang/perl

Install updates from vendor's website.

p5-encode - update to 3.12
Perl - update to 5.35.3
cPanel - addressed in versions 11.94.0.16, 11.98.0.8
Autodesk Infraworks - addressed in versions 2020.2 Hotfix 6, 2021.2 Hotfix 6, 2022.1 Hotfix 4
perl-Encode-help - update to 3.06-2
perl-Encode-debuginfo - update to 3.06-2
perl-Encode - update to 3.06-2
perl-Encode-devel - update to 3.06-2
perl-Encode-debugsource - update to 3.06-2
perl-Encode - addressed in versions 3.08-459.fc33, 3.12-460.fc34
perl (Ubuntu package) - update to 5.32.1-3ubuntu2.1
perl-bootstrap - addressed in versions 5.32-3320210810075712.601d93de, 5.32-3420210810075712.058368ca
perl - addressed in versions 5.32-3320210810132640.94c872f1, 5.32-3420210810132640.866eb18a
dev-lang/perl - update to 5.38.2

• https://security-tracker.debian.org/tracker/CVE-2021-36770
• https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9
• https://news.cpanel.com/unscheduled-tsr-10-august-2021/
• https://metacpan.org/dist/Encode/changes
• https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74

• Privilege escalation in p5-encode
• Privilege escalation via Encode.pm from p5-encode package in Perl
• cPanel security update for p5-encode
• Multiple vulnerabilities in Autodesk InfraWorks
• Ubuntu update for perl
• Multiple vulnerabilities in Middleware Common Libraries and Tools
• openEuler update for perl-Encode
• Multiple vulnerabilities in Oracle Enterprise Manager for Fusion Middleware
• Gentoo update for Perl
• Fedora 34 update for perl-Encode
• Fedora 33 update for perl-Encode
• Fedora 34 Modular update for perl-bootstrap
• Fedora 33 Modular update for perl-bootstrap
• Fedora 34 Modular update for perl
• Fedora 33 Modular update for perl
• Multiple vulnerabilities in Oracle Middleware Common Libraries and Tools