Steffen Ullrich

**Name of the Vulnerable Software and Affected Versions** Net::DNS versions prior to 1.56 **Description** Remote execution injection is possible via EDNS EXTENDED ERROR. The function ` decompose()` in Net::DNS::RR::OPT::EXTENDED ERROR parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option by tokenizing raw bytes and passing the result to Perl's `eval`. While escaping is implemented for $ and @, backticks are not escaped. This allows command execution if `$pkt->edns->option('EXTENDED-ERROR')` is called in array context, specifically when a payload containing backticks is provided in the EXTRA-TEXT field. **Recommendations** Update Net::DNS to a version newer than 1.55.

**Name of the Vulnerable Software and Affected Versions** Net::DNS versions prior to 1.56 **Description** An issue exists where the software allows a Denial of Service via deep DNS compression pointer chains. The `Net::DNS::DomainName::decode` function follows RFC 1035 compression pointers by recursing into itself without a depth limit. While the guard `$link < $offset` prevents forward and circular chains, it allows arbitrarily long backward chains. A crafted packet can chain two-byte compression pointers to saturate the call stack, causing the process to receive a SIGSEGV (segmentation fault) or similar error. This occurs when the library decodes a DNS message from the network via `Net::DNS::Packet->new($wire)`. **Recommendations** Update Net::DNS to version 1.56 or later.

Name of the Vulnerable Software and Affected Versions: IO::Socket::SSL versions 1.14 through 1.25 Description: The certificate checking feature in IO::Socket::SSL has an issue where the `verify hostname of cert` function only matches the prefix of a hostname when no wildcard is used. This allows remote attackers to bypass the hostname check for a certificate. Recommendations: For IO::Socket::SSL versions 1.14 through 1.25, consider updating to a version outside of this range to resolve the issue. As a temporary workaround, restrict the use of the `verify hostname of cert` function to minimize the risk of exploitation.