Skip to content

Commit 91b038e

Browse files
briandfoybriandfoy
committed
Data update for 2024-08-24 (briandfoy/cpan-security-advisory#160)
1 parent efde270 commit 91b038e

File tree

5 files changed

+72
-18
lines changed

5 files changed

+72
-18
lines changed

‎Changes

+3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
Revision history for Perl extension CPAN-Audit
22

3+
20240822.001 2024-08-22T06:32:12Z
4+
* Data update for 2024-08-22
5+
36
20240718.001 2024-07-18T17:32:37Z
47
* data update, and fix for briandfoy/cpan-security-advisory#157
58

‎cpan-security-advisory

‎lib/CPAN/Audit.pm

+1-1
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ use CPAN::Audit::Version;
1414
use CPAN::Audit::Query;
1515
use CPAN::Audit::DB;
1616

17-
our $VERSION = '20240822.001';
17+
our $VERSION = '20240824.001';
1818

1919
sub new {
2020
my( $class, %params ) = @_;

‎lib/CPAN/Audit/DB.pm

+54-3
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
# created by util/generate at Thu Aug 22 02:08:50 2024
2-
# cpan-security-advisory +cf7c1af0eac1915d64b4d4aded75ea7e2ab9525c
1+
# created by util/generate at Fri Aug 23 11:58:01 2024
2+
# cpan-security-advisory +7269468a4aeb9736a5aa0b183d428b243e682572
33
#
44
package CPAN::Audit::DB;
55

66
use strict;
77
use warnings;
88

9-
our $VERSION = '20240822.001';
9+
our $VERSION = '20240823.001';
1010

1111
sub db {
1212
{
@@ -19423,6 +19423,10 @@ sub db {
1942319423
{
1942419424
'date' => '2024-08-20T11:29:56',
1942519425
'version' => '1.643_01'
19426+
},
19427+
{
19428+
'date' => '2024-08-22T07:09:52',
19429+
'version' => '1.643_02'
1942619430
}
1942719431
]
1942819432
},
@@ -35445,6 +35449,53 @@ weakness.
3544535449
],
3544635450
'reported' => '2022-01-25',
3544735451
'severity' => 'critical'
35452+
},
35453+
{
35454+
'affected_versions' => '>=7.44,<=12.23',
35455+
'cves' => [
35456+
'CVE-2021-22204'
35457+
],
35458+
'description' => 'Improper neutralization of user data in the DjVu file format in ExifTool versions 7.44 and up allows arbitrary code execution when parsing the malicious image
35459+
',
35460+
'distribution' => 'Image-ExifTool',
35461+
'fixed_versions' => '>12.23',
35462+
'id' => 'CPANSA-Image-ExifTool-2021-22204',
35463+
'references' => [
35464+
'https://rt.cpan.org/Public/Bug/Display.html?id=>=7.44,<=12.23',
35465+
'http://packetstormsecurity.com/files/162558/ExifTool-DjVu-ANT-Perl-Injection.html',
35466+
'http://packetstormsecurity.com/files/164768/GitLab-Unauthenticated-Remote-ExifTool-Command-Injection.html',
35467+
'http://packetstormsecurity.com/files/164994/GitLab-13.10.2-Remote-Code-Execution.html',
35468+
'http://packetstormsecurity.com/files/167038/ExifTool-12.23-Arbitrary-Code-Execution.html',
35469+
'http://www.openwall.com/lists/oss-security/2021/05/09/1',
35470+
'http://www.openwall.com/lists/oss-security/2021/05/10/5',
35471+
'https://github.com/exiftool/exiftool/commit/cf0f4e7dcd024ca99615bfd1102a841a25dde031#diff-fa0d652d10dbcd246e6b1df16c1e992931d3bb717a7e36157596b76bdadb3800',
35472+
'https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22204.json',
35473+
'https://hackerone.com/reports/1154542',
35474+
'https://lists.debian.org/debian-lts-announce/2021/05/msg00018.html',
35475+
'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDKDLJLBTBBR66OOPXSXCG2PQRM5KCZL/',
35476+
'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F6UOBPU3LSHAPRRJNISNVXZ5DSUIALLV/',
35477+
'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U4RF6PJCJ6NQOVJJJF6HN6BORUQVIXY6/',
35478+
'https://www.debian.org/security/2021/dsa-4910'
35479+
],
35480+
'reported' => '2021-04-23',
35481+
'severity' => undef
35482+
},
35483+
{
35484+
'affected_versions' => '=8.32',
35485+
'cves' => [
35486+
'CVE-2018-20211'
35487+
],
35488+
'description' => 'ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\\\\par-%username%\\\\cache-exiftool-8.32 folder with a victim\'s username, and then copying a Trojan horse ws32_32.dll file into this new folder, aka DLL Hijacking. NOTE: 8.32 is an obsolete version from 2010 (9.x was released starting in 2012, and 10.x was released starting in 2015).
35489+
',
35490+
'distribution' => 'Image-ExifTool',
35491+
'fixed_versions' => '>8',
35492+
'id' => 'CPANSA-Image-ExifTool-2018-20211',
35493+
'references' => [
35494+
'http://packetstormsecurity.com/files/150892/Exiftool-8.3.2.0-DLL-Hijacking.html',
35495+
'http://seclists.org/fulldisclosure/2018/Dec/44'
35496+
],
35497+
'reported' => '2019-01-02',
35498+
'severity' => undef
3544835499
}
3544935500
],
3545035501
'main_module' => 'Image::ExifTool',

‎lib/CPAN/Audit/DB.pm.gpg

+13-13
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
-----BEGIN PGP SIGNATURE-----
22

3-
iQIzBAABCAAdFiEEdaq0LLoNfzfw1oht+D+NXoeLYEEFAmbG1fMACgkQ+D+NXoeL
4-
YEGDoA//RQUD9JP7CZBVvYuqXleUMvK/1tYIllAyzQDSBcwHjNnQ7s6WcDCXDSWY
5-
LKjODCV8iZkMHvFkxxJiFwWp4lswrZP9+hq57dIdjCSfS70mWpc8cLEImfJrALqq
6-
MGkpu/Kbc2dsPQLnvcJIFOtcceB6+4sEUlGAT9VOJOz6l9Cl8PHCNai2/G0C4vGd
7-
dLVxhNOc94KLtQuAdJb6ib8q9GzL+gBCiidqWsHWt4KWLHkzr6nfUFJKAN1vRIKP
8-
laPpldVDzwsH1xwbZrgXZF1mgsh1x3nZN4tl7mVn0c7h6fDty7L5OZS06pgzpwIv
9-
Znq0iD2JkBE4YhZuuZShIGm71SsX4eRA4F4V9Rr1WmkLcxtbnq8KhFHDiDzPyVk4
10-
sWlJnukVsxhdEnn0ldJjKeFskEQ5JyHKYFmZ47TY5bBrS/hpq+9eR36s2XpvWrhG
11-
BowO5hky/Ya1pHIof1UujtIVIlipicSUCevBSbF4PyVTcX1eTOGx9uZgDgUYIcmd
12-
v9L6VB/3/zHLzfJ8PoVbbWR1NfFdoCpMyGqM4Z4d/muhq2RAiymqMh45Hi+Jcwp0
13-
T8kovZGL+KOn44P+Y07JuOscX/UbAbWo3lux0BCg4E1lh7tkH6i+i4fGevMmDWYs
14-
wWc3BX0gJfSn4lZJ/YYuBhRq7RikdTAJxYL6U9gLwuv0YWi7iCg=
15-
=wjXH
3+
iQIzBAABCAAdFiEEdaq0LLoNfzfw1oht+D+NXoeLYEEFAmbIsYkACgkQ+D+NXoeL
4+
YEFd+w/+OghdjVg8VlEc3JHCmCLvxImHXVuSy43J+7xVuUzXEYpDJTc/THQ2mlFp
5+
+a8v9KtJZOBP9W7XP8HXA5reZOW/G+oatjiOgzgoozOxok8IjYPZTCtjo1q7MSTh
6+
4AkkmPF72mSXkKqyTBQHePp1U4TlzL2deTppJQQkyv3o969TgHgok0N/PPrSch9q
7+
jlBDFIu9veo8DMBJ1kfqnEj6swSSKqad/HSmXNh/KLN+cF9Nvh2EdXv5AYRbU5uI
8+
DQA4vzSJD585TNEnLxISGFiHLIyJdl+zJM3iD2bg40F+CwVVK7lLsONnDx7ZNVRO
9+
Ue+exOdJweWHtDNJiKs98WX0/gBd0D1Xj39VN68fFE9y0L1ILAhIAbVbG3SJ6sD0
10+
GJP9f6b+rJj+C6padV0+7HA0e0TptLA+7y+qiD21few+pW7XK/8hm5bVFH1aWyRU
11+
CKc5YdmKy+0rPGQtnP9YMnpIyyOESxUsNS5d4059ShsBiD2dBOCdwBUsKozXxe+E
12+
DO1BX3M+kPzVVcsrfN7iQAw4tqfEaXaCbpaVPCTRdTQQBIzLIFnyneuCa7IzG81Z
13+
XxfskSSNbQi5PNstkij2+3z+Ev+5QKkGDMGv4uPXT+KWshrIEwpsiMc3QjpQqw49
14+
IWRcSMauTmQOchIGYHgCA1HtpVcmiAQcqXwFeyb96iyBwU773pA=
15+
=/ka7
1616
-----END PGP SIGNATURE-----

0 commit comments

Comments
 (0)