一、漏洞信息
漏洞编号:CVE-2023-47100
漏洞归属组件:perl
漏洞归属的版本:5.28.3,5.32.0,5.34.0,5.38.0
CVSS V3.0分值:
BaseScore:9.8 Critical
Vector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
漏洞简述:
In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a property name associated with a p{...} regular expression construct is mishandled. The earliest affected version is 5.30.0.
漏洞公开时间:2023-12-03 07:15:07
漏洞创建时间:2023-12-03 08:30:03
漏洞详情参考链接:
https://nvd.nist.gov/vuln/detail/CVE-2023-47100
漏洞分析指导链接:
https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
漏洞数据来源:
openBrain开源漏洞感知系统
漏洞补丁信息:
影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源 |
---|---|---|---|---|
https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010 | cve.mitre.org | |||
https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6 | cve.mitre.org | |||
https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3 | cve.mitre.org | |||
https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3 | suse_bugzilla |
二、漏洞分析结构反馈
影响性分析说明:
perl对于 p{...}正则表达式结构相关联的属性名被错误处理,会导致越界修改缓冲区
openEuler评分:
9.8
Vector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
受影响版本排查(受影响/不受影响):
1.openEuler-22.03-LTS(5.34.0):受影响
2.openEuler-22.03-LTS-SP1:受影响
3.openEuler-22.03-LTS-SP2:受影响
4.openEuler-22.03-LTS-SP3:受影响
5.openEuler-20.03-LTS-SP1(5.28.3):不受影响
6.openEuler-20.03-LTS-SP3(5.28.3):不受影响
7.openEuler-20.03-LTS-SP4:不受影响
修复是否涉及abi变化(是/否):
1.openEuler-20.03-LTS-SP1(5.28.3):否
2.openEuler-20.03-LTS-SP3(5.28.3):否
3.openEuler-20.03-LTS-SP4:否
4.openEuler-22.03-LTS(5.34.0):否
5.openEuler-22.03-LTS-SP1:否
6.openEuler-22.03-LTS-SP2:否
7.openEuler-22.03-LTS-SP3:否
三、漏洞修复
安全公告链接:https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2023-1928