Stig Palmquist

**Name of the Vulnerable Software and Affected Versions** Imager::File::JPEG versions prior to 1.003 Imager versions prior to 1.032 **Description** A heap memory leak occurs when reading a JPEG file containing repeated APP13 markers. The function `i readjpeg wiol()` iterates through the marker list provided by libjpeg and allocates a new buffer using `mymalloc()` for each APP13 marker, overwriting the previous pointer without freeing the memory. Consequently, only the final payload is freed, causing the first N-1 payloads to leak on every read. In long-lived processes, such as thumbnailing or upload services, these leaks can accumulate and exhaust available memory, leading to a denial of service. **Recommendations** Update Imager::File::JPEG to version 1.003 or later. Update Imager to version 1.032 or later.

**Name of the Vulnerable Software and Affected Versions** CryptX versions prior to 0.088 001 **Description** CryptX for Perl performs AEAD authentication tag comparisons in non-constant time within the streaming `decrypt done` path. The `decrypt done($tag)` function utilizes `memNE` (based on `memcmp() != 0`), which terminates the comparison at the first differing byte. This behavior creates a tag-verification oracle, where the execution time depends on the number of matching leading bytes. This issue affects GCM, CCM, ChaCha20Poly1305, EAX, and OCB modes. An attacker capable of submitting numerous candidate tags for the same nonce, ciphertext, and associated data while precisely measuring timing may recover the expected tag byte by byte to forge a verifying message. One-shot `* decrypt verify` helpers are not affected as they use constant-time comparisons within libtomcrypt. **Recommendations** Update CryptX to version 0.088 001 or later.

**Name of the Vulnerable Software and Affected Versions** IO::Uncompress::Unzip versions prior to 2.220 **Description** An issue in the `fastForward()` function allows CPU exhaustion. The function compares the length of the `$offset` variable (the digit count of the offset, ranging from 1 to 19) against the chunk size `$c` instead of comparing the `$offset` value itself. This causes the chunk size `$c` to shrink from 16 KiB to between 1 and 19 bytes per iteration. An attacker can trigger a per-byte read loop that scales with the compressed size of an entry, up to the 4 GiB non-Zip64 limit, by extracting a named entry from a malicious zip file using `IO::Uncompress::Unzip->new($zip, Name => $target)`. **Recommendations** Update to version 2.220 or later.

**Name of the Vulnerable Software and Affected Versions** HTTP::Daemon versions prior to 6.17 **Description** OS command injection is possible through the `send file()` function. This occurs because `send file()` utilizes Perl's 2-arg open() function, which interprets magic prefixes. Specifically, prefixes like '| cmd' and 'cmd |' open a pipe to a subprocess, while '> path' and '>> path' open a path for writing or appending. If untrusted input is passed to `send file()`, OS commands can be executed with the daemon process UID. Additionally, the read-pipe form ('cmd |') can leak subprocess stdout into the HTTP response body, and write-mode forms can create or truncate files at paths chosen by an attacker. **Recommendations** Update to version 6.17 or later. As a temporary workaround, restrict or avoid passing untrusted input to the `send file()` function.

**Name of the Vulnerable Software and Affected Versions** IO::Compress versions 2.207 through 2.219 **Description** The bundled zipdetails CLI tool crashes when processing an Info-ZIP Unix Extra Field (tag 0x7875) where the UID Size or GID Size is set to 8. This occurs because the `decode ux()` function triggers `decodeLitteEndian()`, which attempts to call a misnamed helper function `unpackValueQ`. Since the actual function is defined as `unpackValue Q`, the script fails with an undefined subroutine error and exits. Library callers of IO::Compress and IO::Uncompress are not affected. **Recommendations** Update to version 2.220.

**Name of the Vulnerable Software and Affected Versions** Archive::Tar versions prior to 3.08 **Description** Archive::Tar for Perl allows the extraction of hardlinks to attacker-controlled paths outside the intended extraction directory. The function ` make special file()` passes the tar header's linkname to `link()` without validating it against absolute paths or `..` segments, which creates a hardlink sharing the victim file's inode. A subsequent write through the extracted name modifies the victim file. Additionally, the post-extraction chmod, chown, and utime block in ` extract file()` applies the tar header's mode, owner, and timestamps to the shared inode during extraction, as it is only guarded against symlinks via `-l`. **Recommendations** Update to version 3.08 or later.

**Name of the Vulnerable Software and Affected Versions** Archive::Tar versions prior to 3.10 **Description** Archive::Tar for Perl allows memory exhaustion when processing a tar header with an attacker-controlled entry size field. The ` read tar()` function reads each entry's payload using `$handle->read($$data, $block)`, where the `$block` variable is derived from the 12-byte size field in the tar header without an upper bound. A crafted header specifying a multi-gigabyte size forces Perl to allocate a scalar of that size, leading to memory exhaustion. **Recommendations** Update to version 3.10 or later.

**Name of the Vulnerable Software and Affected Versions** Archive::Tar versions prior to 3.08 **Description** Archive::Tar for Perl allows the extraction of symlinks with attacker-controlled targets located outside the extraction directory. The function ` make special file()` passes the tar header's linkname to `symlink()` without validating it against absolute paths or `..` segments. While a secure-extract mode exists to guard regular file extraction, it does not cover the symlink target. Consequently, a subsequent open operation through the extracted name can read or write to an attacker-chosen path. **Recommendations** Update Archive::Tar to version 3.08 or later.

**Name of the Vulnerable Software and Affected Versions** WebDyne::Session versions prior to 3.003 704 **Description** The session handler generates session identifiers insecurely using an MD5 hash seeded with the built-in `rand()` function. The `rand()` function is seeded by 32-bits, making it predictable and unsuitable for cryptographic purposes. Although the function is passed a maximum value based on the process ID, epoch time, and the reference address of the object, these factors do not improve the quality of the message digest seed. This predictability could allow an attacker to gain unauthorized access to systems. **Recommendations** Update WebDyne::Session to version 3.003 704 or later.

**Name of the Vulnerable Software and Affected Versions** App::cpanminus versions 1.7047 and earlier **Description** The App::cpanminus package for Perl downloads code via insecure HTTP, enabling code execution for network attackers. This issue allows attackers to intercept traffic. **Recommendations** For App::cpanminus versions 1.7047 and earlier, consider disabling the use of insecure HTTP downloads until a patch is available. As a temporary workaround, restrict access to the module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GitLab::API::v4 versions 0.26 and earlier **Description** The issue allows for machine-in-the-middle attacks due to the lack of TLS certificate verification when connecting to a GitLab server. **Recommendations** For GitLab::API::v4 versions 0.26 and earlier, update to a version that verifies TLS certificates to prevent machine-in-the-middle attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPAN.pm versions prior to 2.35 **Description** The issue is related to errors in the TLS certificate authentication procedure, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem stems from the failure to verify TLS certificates when downloading distributions over HTTPS. This can lead to a man-in-the-middle attack, where an attacker could gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system. **Recommendations** For versions prior to 2.35, update to version 2.35 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS for distribution downloads until a patch is available. Restrict access to sensitive information and communication channels to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** App::cpanminus version 1.7044 **Description** The issue allows Signature Verification Bypass. **Recommendations** For version 1.7044, update to a version that fixes the Signature Verification Bypass issue.

**Name of the Vulnerable Software and Affected Versions** CPAN::Checksums version 2.12 **Description** The issue concerns the CPAN::Checksums package for Perl, which does not uniquely define signed data. This could potentially lead to security issues, although specific details about exploitation or affected devices are not provided. **Recommendations** For CPAN::Checksums version 2.12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** CPAN version 2.28 **Description** The issue is related to the incorrect verification of cryptographic signatures in the CPAN language, specifically in the `Module::Signature:: verify()` function. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. **Recommendations** For CPAN version 2.28, consider disabling the `Module::Signature:: verify()` function as a temporary workaround until a patch is available. Restrict access to sensitive data and modules that rely on cryptographic signature verification to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Digi TransPort LR54 version 4.4.0.26 and possible earlier versions Description: The issue is related to Improper Input Validation, allowing users with 'super' CLI access privileges to bypass a restricted shell and execute arbitrary commands as root. Recommendations: For version 4.4.0.26 and possible earlier versions, restrict `super` CLI access privileges to prevent bypassing of the restricted shell until a fix is available. Consider limiting the execution of arbitrary commands as root to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** python-gnupg version 0.4.3 **Description** The issue is related to improper input validation, allowing context-dependent attackers to trick gnupg into decrypting other ciphertext than intended. This can be achieved if the passphrase to gnupg is controlled by the adversary and the ciphertext is trusted. The vulnerability exists due to insufficient input validation in the gnupg.GPG.encrypt() and gnupg.GPG.decrypt() methods of the python-gnupg package, which may allow an attacker to execute arbitrary code. **Recommendations** For python-gnupg version 0.4.3, consider restricting the use of the `gnupg.GPG.encrypt()` and `gnupg.GPG.decrypt()` methods until a patch is available. Additionally, ensure that the passphrase to gnupg is securely managed and that only trusted ciphertext is processed. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** HTTP-Body module for Perl versions 1.07 through 1.22 **Description** The issue allows remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix of a temporary file is well-formed. This is because the `HTTP::Body::Multipart` function uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file. **Recommendations** For versions 1.07 through 1.22, update to version 1.23 or later to resolve the issue.