Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2021-36770: Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic modul...
CVE-2021-36770 · published 5 years ago
Summary
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05...
What to do
- Update canonical perl to version 5.32.1-3ubuntu3.
- Update debian libencode-perl to version 3.08-2.
- Update debian perl to version 5.32.1-5.
- Update p5-encode_project p5-encode to version 3.12 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | p5-encode_project | p5-encode |
>= 3.05, < 3.12 cpe:2.3:a:p5-encode_project:p5-encode:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
34 33 cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Ubuntu:16.04:LTS | canonical | libencode-perl | All versions |
| Ubuntu:22.04:LTS | canonical | perl |
< 5.32.1-3ubuntu3 Fix: upgrade to 5.32.1-3ubuntu3
|
| Debian:12 | debian | libencode-perl |
< 3.08-2 Fix: upgrade to 3.08-2
|
| Debian:12 | debian | perl |
< 5.32.1-5 Fix: upgrade to 5.32.1-5
|
Original advisory text
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic modul...
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
References
- https://metacpan.org/dist/Encode/changes Vendor Advisory
- https://ubuntu.com/security/CVE-2021-36770 Third Party Advisory
- https://ubuntu.com/security/notices/USN-5033-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-36770 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2021-36770 Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... URL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... URL
- https://news.cpanel.com/unscheduled-tsr-10-august-2021/ Vendor Advisory
- https://security.netapp.com/advisory/ntap-20210909-0003/ Vendor Advisory
- https://security.netapp.com/advisory/ntap-20241108-0002/ Vendor Advisory
- https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9 Patch
- https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d7... Patch
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-427Uncontrolled Search Path Element
Timeline
Published11 Aug 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-36770 · NVD
UBUNTU-CVE-2021-36770 · OSV
CVE-2021-36770 · OSV
DEBIAN-CVE-2021-36770 · OSV
Track software like this
Free during beta