CVE-2013-2145 The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special un...
MediumCVSS 4.4
EPSS 0.55%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libmodule-signature-perl(Debian:12) | < 0.73-1 | 0.73-1 |
| debian/libmodule-signature-perl(Debian:13) | < 0.73-1 | 0.73-1 |
| debian/libmodule-signature-perl(Debian:14) | < 0.73-1 | 0.73-1 |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 12.10 | No fix listed |
| Canonical Ubuntu Linux | = 13.04 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.2 | No fix listed |
| opensuse | = 12.3 | No fix listed |
| perlmonks modulesignature | <= 0.72 | No fix listed |
| perlmonks modulesignature | = 0.70 | No fix listed |
| perlmonks modulesignature | = 0.71 | No fix listed |
References
- Debian Security Tracker CVE-2013-2145 vendor-advisory
- openSUSE-SU-2013:1178 vendor-advisory
- openSUSE-SU-2013:1185 vendor-advisory
- [oss-security] 20130605 CVE-2013-2145: perl Module::Signature code execution vulnerability mailing-list
- 60352 vdb-entry
- USN-1896-1 vendor-advisory
- bugzilla.redhat.com
- github.com exploit patch
- github.com exploit patch
- bugs.debian.org issue-tracking