|
|
| |
|
| |
perl-Module-Metadata: code execution
| Package(s): | perl-Module-Metadata |
CVE #(s): | CVE-2013-1437
|
| Created: | September 3, 2013 |
Updated: | September 5, 2013 |
| Description: |
From the Red Hat bug report:
It was reported that the perl Module::Metadata module incorrectly claimed that it would gather metadata about a .pm file without executing unsafe code. However, when Module::Metadata determines the version of a module, it can extract a small amount of code (if present in the $Version variable assignment) and evaluates it, which can lead to the execution of arbitrary code (the same code that module would execute to obtain the value of $Version). |
| Alerts: |
|
( Log in to post comments)
|
|
|