LWN.net Logo

perl-Module-Metadata: code execution

Package(s):perl-Module-Metadata CVE #(s):CVE-2013-1437
Created:September 3, 2013 Updated:September 5, 2013
Description: From the Red Hat bug report:

It was reported that the perl Module::Metadata module incorrectly claimed that it would gather metadata about a .pm file without executing unsafe code. However, when Module::Metadata determines the version of a module, it can extract a small amount of code (if present in the $Version variable assignment) and evaluates it, which can lead to the execution of arbitrary code (the same code that module would execute to obtain the value of $Version).

Alerts:
Fedora FEDORA-2013-15157 2013-08-30
Fedora FEDORA-2013-15196 2013-08-30

(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds