CVE-2021-36770

Katalog CVE

CVSS 7.8 · High EPSS 1,4%

Kerentanan Uncontrolled Search Path Element pada p5-encode project p5-encode, fedoraproject fedora. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

Rincian

Terbit di NVD

11 Agustus 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-427: Uncontrolled Search Path Element

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9 patch · advisory pihak ketiga
• https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74 patch · advisory pihak ketiga
• https://metacpan.org/dist/Encode/changes advisory pihak ketiga
• https://news.cpanel.com/unscheduled-tsr-10-august-2021/ advisory pihak ketiga
• https://security-tracker.debian.org/tracker/CVE-2021-36770 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210909-0003/ advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75F...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KOZYD7BH2DNI...
• https://security.netapp.com/advisory/ntap-20241108-0002/