CPANSA-Module-Load-2011-10043

Permalink JSON

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed t...

Affected Packages	Affected Versions	Fixed Versions
cpan:Module-Load	< 0.22	0.22
376 Dependent packages 0 Dependent repositories Affected Version Ranges All affected versions All unaffected versions

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary code.

References:

https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html
https://metacpan.org/release/BINGOS/Module-Load-0.22/changes
https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Advisories

CPANSA-Module-Load-2011-10043

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed t...

Affected Version Ranges

All affected versions

All unaffected versions

Identifiers

Risk

Source

Origin

Date and time

Published

Updated

API