VDB
ALPINE-CVE-2021-36770
ALPINE-CVE-2021-36770
PUBLISHED
CVSS 7.800000190734863 HIGH
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
Risk Scores
CVSS 3.1
7.800000190734863
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.17 | perl-encode | 3.09-r0, 3.08-r0, 3.07-r1 |
| Alpine:v3.18 | perl-encode | 3.07-r0, 0, 3.11-r0 |
| Alpine:v3.15 | perl | 5.24.0-r0, 5.14.1-r0, 5.22.1-r0 |
| Alpine:v3.21 | perl | 5.24.0-r1, 5.22.2-r0, 5.22.1-r0 |
| Alpine:v3.24 | perl | 0, 0 |
| Alpine:v3.22 | perl | 5.12.2-r1, 5.14.2-r1, 0 |
| Alpine:v3.16 | perl-encode | 0, 2.75-r0, 3.11-r0 |
| Alpine:v3.23 | perl | 5.26.2-r0, 5.26.1-r1, 5.26.1-r0 |
| Alpine:v3.16 | perl | 5.26.2-r1, 0, 5.10.0-r0 |
| Alpine:v3.19 | perl-encode | 2.76-r1, 2.86-r0, 2.88-r0 |
| Alpine:v3.21 | perl-encode | 3.11-r0, 3.10-r1, 3.11-r0 |
| Alpine:v3.23 | perl-encode | 0, 0, 3.11-r0 |
| Alpine:v3.22 | perl-encode | 3.04-r0, 2.76-r1, 0 |
| Alpine:v3.17 | perl | 5.18.0-r0, 5.24.0-r0, 5.24.0-r1 |
| Alpine:v3.20 | perl-encode | 2.70-r0, 2.75-r0, 2.76-r0 |
| Alpine:v3.20 | perl | 5.12.3-r0, 5.10.0-r0, 5.10.1-r0 |
| Alpine:v3.24 | perl-encode | 0, 0 |
| Alpine:v3.19 | perl | 5.26.1-r0, 5.10.0-r0, 5.10.0-r1 |
| Alpine:v3.18 | perl | 5.26.2-r1, 0, 0 |
| Alpine:v3.15 | perl-encode | 0, 2.75-r0, 2.76-r0 |
Timeline
- Aug 11, 2021 CVE Published
- Jun 15, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch