Perl Digest-Base module: Arbitrary code execution

Perl Digest-Base module: Arbitrary code execution A vulnerability has been found in the Digest-Base Perl module, allowing remote attackers to execute arbitrary code. digest-base 2014-01-29 2014-01-29: 1 385487 remote 1.170.0 1.170.0

Digest-Base is a set of Perl modules that calculate message digests

The vulnerability is caused due to the “Digest->new()” function not properly sanitising input before using it in an “eval()” call.

The vulnerability might allow an attacker to execute arbitrary code.

There is no known workaround at this time.

All Digest-Base module users should upgrade to the latest version:


      # emerge --sync
      # emerge --ask --oneshot --verbose ">=perl-core/digest-base-1.170.0"

CVE-2011-3597 pinkbyte pinkbyte