CVE-2021-36770: Uncontrolled Search Path Element (CWE-427)
value: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
CWE description: The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CVSS v3 base score: 7.8
Published: 2021-08-11T23:15Z
Repository: https://github.com/dankogai/p5-encode
Language: Other
Files changed: Changes, Encode.pm, Unicode/Unicode.xs, t/Unicode.t
Commit date: 2021-08-09 23:19:25 +0900
Commit message: version 3.12 to address CVE-2021-36770

Diff: diff --git a/Changes b/Changes
index 2c7bc7a..39e0bc1 100644
--- a/Changes
+++ b/Changes
@@ -1,10 +1,14 @@
 # Revision history for Perl extension Encode.
 #
-# $Id: Changes,v 3.11 2021/07/23 02:26:54 dankogai Exp dankogai $
+# $Id: Changes,v 3.12 2021/08/09 14:17:04 dankogai Exp dankogai $
 #
-$Revision: 3.11 $ $Date: 2021/07/23 02:26:54 $
+$Revision: 3.12 $ $Date: 2021/08/09 14:17:04 $
+! Encode.pm
+  Address CVE-2021-36770
+  <9639159a-d070-4762-9cbd-f1622f10449c@beta.fastmail.com>
+3.11 2021/07/23 02:26:54
 ! Unicode/Unicode.xs
 + t/Unicode_trailing_nul.t
   Pulled: Ensure that UTF-16 decode always includes a trailing NUL.
   https://github.com/dankogai/p5-encode/pull/160
 ! Unicode/Unicode.pm t/Unicode.t
diff --git a/Encode.pm b/Encode.pm
index 1502a16..841ec23 100644
--- a/Encode.pm
+++ b/Encode.pm
@@ -1,15 +1,15 @@
 #
-# $Id: Encode.pm,v 3.11 2021/07/23 02:26:02 dankogai Exp $
+# $Id: Encode.pm,v 3.12 2021/08/09 14:17:04 dankogai Exp dankogai $
 #
 package Encode;
 use strict;
 use warnings;
 use constant DEBUG => !!$ENV{PERL_ENCODE_DEBUG};
 our $VERSION;
 BEGIN {
-    $VERSION = sprintf "%d.%02d", q$Revision: 3.11 $ =~ /(\d+)/g;
+    $VERSION = sprintf "%d.%02d", q$Revision: 3.12 $ =~ /(\d+)/g;
     require XSLoader;
     XSLoader::load( __PACKAGE__, $VERSION );
 }
 
 use Exporter 5.57 'import';
@@ -63,12 +63,12 @@ require Encode::Config;
 #  https://bugzilla.redhat.com/show_bug.cgi?id=435505#c2
 #  to find why sig handlers inside eval{} are disabled.
 eval {
     local $SIG{__DIE__};
     local $SIG{__WARN__};
-    local @INC = @INC || ();
-    pop @INC if $INC[-1] eq '.';
+    local @INC = @INC;
+    pop @INC if @INC && $INC[-1] eq '.';
     require Encode::ConfigLocal;
 };
 
 sub encodings {
     my %enc;
diff --git a/Unicode/Unicode.xs b/Unicode/Unicode.xs
index 0db4f4e..cc4817e 100644
--- a/Unicode/Unicode.xs
+++ b/Unicode/Unicode.xs
@@ -1,7 +1,7 @@
 /*
- $Id: Unicode.xs,v 2.20 2021/07/23 02:26:54 dankogai Exp dankogai $
+ $Id: Unicode.xs,v 2.20 2021/07/23 02:26:54 dankogai Exp $
  */
 
 #define IN_UNICODE_XS
 
 #define PERL_NO_GET_CONTEXT
diff --git a/t/Unicode.t b/t/Unicode.t
index cac6c7d..61cef42 100644
--- a/t/Unicode.t
+++ b/t/Unicode.t
@@ -1,7 +1,7 @@
 #
-# $Id: Unicode.t,v 2.4 2021/07/23 02:26:54 dankogai Exp dankogai $
+# $Id: Unicode.t,v 2.4 2021/07/23 02:26:54 dankogai Exp $
 #
 # This script is written entirely in ASCII, even though quoted literals
 # do include non-BMP unicode characters -- Are you happy, jhi?
 #
 

Vulnerable code: # $Id: Changes,v 3.11 2021/07/23 02:26:54 dankogai Exp dankogai $
$Revision: 3.11 $ $Date: 2021/07/23 02:26:54 $
# $Id: Encode.pm,v 3.11 2021/07/23 02:26:02 dankogai Exp $
    $VERSION = sprintf "%d.%02d", q$Revision: 3.11 $ =~ /(\d+)/g;
    local @INC = @INC || ();
    pop @INC if $INC[-1] eq '.';
 $Id: Unicode.xs,v 2.20 2021/07/23 02:26:54 dankogai Exp dankogai $
# $Id: Unicode.t,v 2.4 2021/07/23 02:26:54 dankogai Exp dankogai $
Fixed code: # $Id: Changes,v 3.12 2021/08/09 14:17:04 dankogai Exp dankogai $
$Revision: 3.12 $ $Date: 2021/08/09 14:17:04 $
! Encode.pm
  Address CVE-2021-36770
  <9639159a-d070-4762-9cbd-f1622f10449c@beta.fastmail.com>
3.11 2021/07/23 02:26:54
# $Id: Encode.pm,v 3.12 2021/08/09 14:17:04 dankogai Exp dankogai $
    $VERSION = sprintf "%d.%02d", q$Revision: 3.12 $ =~ /(\d+)/g;
    local @INC = @INC;
    pop @INC if @INC && $INC[-1] eq '.';
 $Id: Unicode.xs,v 2.20 2021/07/23 02:26:54 dankogai Exp $
# $Id: Unicode.t,v 2.4 2021/07/23 02:26:54 dankogai Exp $