Vulnetix
Try Vulnetix Request Demo
ALPINE-CVE-2021-36770 PUBLISHED CVSS 7.800000190734863 HIGH

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Risk Scores

CVSS v3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.17perl-encode2.88-r2, 3.11-r0, 3.10-r1
Alpine:v3.18perl-encode3.11-r0, 3.10-r0, 3.09-r0
Alpine:v3.15perl5.30.3-r0, 0, 5.10.0-r0
Alpine:v3.21perl0, 5.10.0-r0, 5.10.1-r0
Alpine:v3.22perl5.24.0-r0, 5.34.0-r0, 5.32.1-r0
Alpine:v3.16perl-encode2.75-r0, 3.11-r0, 3.10-r1
Alpine:v3.23perl5.26.1-r1, 5.26.1-r0, 5.26.0-r0
Alpine:v3.16perl5.10.1-r0, 0, 5.34.0-r0
Alpine:v3.19perl-encode3.11-r0, 0, 2.75-r0
Alpine:v3.21perl-encode3.11-r0, 0, 2.70-r0
Alpine:v3.23perl-encode3.11-r0, 0, 2.70-r0
Alpine:v3.22perl-encode2.70-r0, 2.76-r0, 2.76-r1
Alpine:v3.17perl5.24.0-r1, 5.34.0-r0, 5.32.1-r0
Alpine:v3.20perl-encode3.11-r0, 3.10-r1, 3.10-r0
Alpine:v3.20perl5.10.1-r1, 5.22.2-r0, 5.24.0-r0
Alpine:v3.19perl5.16.1-r0, 5.34.0-r0, 5.32.1-r0
Alpine:v3.18perl5.10.0-r0, 5.10.0-r1, 5.10.1-r0
Alpine:v3.15perl-encode3.11-r0, 3.10-r1, 3.10-r0

Timeline

References

Open in Interactive Console →