CVE-2017-20230: Storable versions before 3.05 for Perl has a stack overflow
Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2017-20230?
CVE-2017-20230 is considered a critical vulnerability due to the potential for remote code execution resulting from the stack overflow.
How do I fix CVE-2017-20230?
To fix CVE-2017-20230, upgrade to Storable version 3.05 or later.
What is the impact of CVE-2017-20230 on affected software?
The impact of CVE-2017-20230 includes the potential for an attacker to exploit a stack overflow, leading to arbitrary code execution on the affected system.
Which versions of Storable are affected by CVE-2017-20230?
CVE-2017-20230 affects all Storable versions prior to 3.05.
What is the cause of CVE-2017-20230?
CVE-2017-20230 is caused by the retrieve_hook function's mishandling of the class name length as a signed integer during read operations.