CVE-2022-48522
perl: stack-based crash in S_find_uninit_var()
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (baja).
Descripción
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 12 | perl | 5.36.0-4 |
| debian 13 | perl | 5.36.0-4 |
| debian 14 | perl | 5.36.0-4 |
| echo | perl | 5.36.0-4 |
| rapidfort ubuntu 20.04 | perl, rf-perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 22.04 | perl, rf-perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 24.04 | perl, rf-perl | 0:5.34.0-3ubuntu1.3 |
| root.io debian 12 | rootio-perl | 5.36.0-4 |
| ubuntu 22.04 | perl | 5.34.0-3ubuntu1.3 |
Mostrar las 12 entradas de 9 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 12 | perl | 5.36.0-4 |
| debian 13 | perl | 5.36.0-4 |
| debian 14 | perl | 5.36.0-4 |
| echo | perl | 5.36.0-4 |
| rapidfort ubuntu 20.04 | perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 20.04 | rf-perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 22.04 | perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 22.04 | rf-perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 24.04 | perl | 0:5.34.0-3ubuntu1.3 |
| rapidfort ubuntu 24.04 | rf-perl | 0:5.34.0-3ubuntu1.3 |
| root.io debian 12 | rootio-perl | 5.36.0-4 |
| ubuntu 22.04 | perl | 5.34.0-3ubuntu1.3 |
Referencias
- https://access.redhat.com/security/cve/CVE-2022-48522
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://github.com/Perl/perl5/blob/79a7b254d85a10b65126ad99bf10e70480569d68/sv.c#L16336-L16345
- https://github.com/Perl/perl5/commit/23cca2d1f4544cb47f1124d98c308ce1f31f09a6
- https://github.com/Perl/perl5/issues/19147
- https://nvd.nist.gov/vuln/detail/CVE-2022-48522
- https://security.netapp.com/advisory/ntap-20230915-0008/
- https://ubuntu.com/security/notices/USN-6517-1