[Bug 1646751] CVE-2018-18314 perl: Heap-based buffer overflow in
S_regatom()
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1646751
Paul Harvey <pharvey(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2018 |impact=moderate,public=2018
|1129,reported=20181105,sour |1129,reported=20181105,sour
|ce=upstream,cvss3=7.0/CVSS: |ce=upstream,cvss3=7.0/CVSS:
|3.0/AV:N/AC:H/PR:N/UI:N/S:U |3.0/AV:N/AC:H/PR:N/UI:N/S:U
|/C:L/I:L/A:H,cwe=CWE-122,rh |/C:L/I:L/A:H,cwe=CWE-122,rh
|el-6/perl=notaffected,opens |el-6/perl=notaffected,opens
|hift-enterprise-3/perl=new, |hift-enterprise-3/perl=nota
|fedora-all/perl=affected,rh |ffected,fedora-all/perl=aff
|el-5/perl=notaffected,rhel- |ected,rhel-5/perl=notaffect
|7/perl=notaffected,openshif |ed,rhel-7/perl=notaffected,
|t-online-3/perl=new,rhel-8/ |openshift-online-3/perl=not
|perl=affected,rhscl-3/rh-pe |affected,rhel-8/perl=affect
|rl526-perl=affected,rhscl-3 |ed,rhscl-3/rh-perl526-perl=
|/rh-perl524-perl=affected,r |affected,rhscl-3/rh-perl524
|hel-8/perl:5.24/perl=affect |-perl=affected,rhel-8/perl:
|ed |5.24/perl=affected
--- Comment #11 from Paul Harvey <pharvey(a)redhat.com> ---
openshift-enterprise-3: notaffected. I reviewed OpenShift containers for
applications with dependencies on perl and was unable to identify any where the
perl interpreter would be exposed to attacker-controlled regular expressions
which could expose this flaw. There is a perl dependency in our MariaDB
packaging, however the only non-test related perl usage is in a backup script
(mysqlhotcopy) which is not exposed to attacker-controlled regular expressions.
I have not filed trackers as these images will inherit the existing perl fixes
next time they are respun. See also https://access.redhat.com/articles/2803031
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years
[Bug 1646738] CVE-2018-18313 perl: Heap-based buffer read overflow
in S_grok_bslash_N()
by bugzilla@redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1646738
Paul Harvey <pharvey(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=low,public=20181129, |impact=low,public=20181129,
|reported=20181105,source=up |reported=20181105,source=up
|stream,cvss3=6.5/CVSS:3.0/A |stream,cvss3=6.5/CVSS:3.0/A
|V:N/AC:H/PR:N/UI:N/S:U/C:L/ |V:N/AC:H/PR:N/UI:N/S:U/C:L/
|I:N/A:H,cwe=CWE-125,rhel-6/ |I:N/A:H,cwe=CWE-125,rhel-6/
|perl=notaffected,openshift- |perl=notaffected,openshift-
|enterprise-3/perl=new,fedor |enterprise-3/perl=notaffect
|a-all/perl=affected,rhel-5/ |ed,fedora-all/perl=affected
|perl=notaffected,rhel-7/per |,rhel-5/perl=notaffected,rh
|l=notaffected,openshift-onl |el-7/perl=notaffected,opens
|ine-3/perl=new,rhel-8/perl= |hift-online-3/perl=notaffec
|affected,rhscl-3/rh-perl526 |ted,rhel-8/perl=affected,rh
|-perl=affected,rhscl-3/rh-p |scl-3/rh-perl526-perl=affec
|erl524-perl=affected,rhel-8 |ted,rhscl-3/rh-perl524-perl
|/perl:5.24/perl=affected |=affected,rhel-8/perl:5.24/
| |perl=affected
--- Comment #11 from Paul Harvey <pharvey(a)redhat.com> ---
openshift-enterprise-3: notaffected. I reviewed OpenShift containers for
applications with dependencies on perl and was unable to identify any where the
perl interpreter would be exposed to attacker-controlled regular expressions
which could expose this flaw. There is a perl dependency in our MariaDB
packaging, however the only non-test related perl usage is in a backup script
(mysqlhotcopy) which is not exposed to attacker-controlled regular expressions.
I have not filed trackers as these images will inherit the existing perl fixes
next time they are respun. See also https://access.redhat.com/articles/2803031
--
You are receiving this mail because:
You are on the CC list for the bug.
4 years