CVE-2023-47038
Assigner: redhat
Published: 2023-12-18T13:43:07.713Z
State: PUBLISHED
title: Perl: write past buffer end via illegal user-defined unicode property
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
descriptions: value: A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
affected: vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: perl:5.32
defaultStatus: affected
versions: version: 8100020240314121426.9fe1d287
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:8::appstream
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: perl
defaultStatus: affected
versions: version: 4:5.32.1-481.el9
lessThan: *
versionType: rpm
status: unaffected
cpes: cpe:/a:redhat:enterprise_linux:9::appstream
vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: perl
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: perl
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: perl
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:8
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: perl:5.30/perl
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
datePublic: 2023-11-25T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-122
description: Heap-based Buffer Overflow
type: CWE
x_redhatCweChain: CWE-122: Heap-based Buffer Overflow
workarounds: value: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
timeline: time: 2023-11-11T00:00:00+00:00
value: Reported to Red Hat.
time: 2023-11-25T00:00:00+00:00
value: Made public.