CVE-2021-36770: High severity ibm cognos analytics vulnerability
Encode could allow a local authenticated attacker to gain elevated privileges on the system, caused by an untrusted search path flaw. By using a specially-crafted Encode::ConfigLocal library, an attacker could exploit this vulnerability to gain elevated privileges.
Other sources
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-36770?
CVE-2021-36770 is a vulnerability in Perl through 5.34.0 that allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library.
How can local users exploit CVE-2021-36770?
Local users can exploit CVE-2021-36770 by placing a specially crafted Encode::ConfigLocal library in the current working directory to preempts dynamic module loading.
Which versions of Perl and libencode-perl are affected by CVE-2021-36770?
Versions 3.00-1+deb10u1, 3.08-1+deb11u2, 3.08-1+deb11u1, 3.19-1 of libencode-perl and versions 5.28.1-6+deb10u1, 5.32.1-4+deb11u2, 5.32.1-4+deb11u1, 5.36.0-7, 5.36.0-9 of Perl are affected by CVE-2021-36770.
What is the severity of CVE-2021-36770?
CVE-2021-36770 has a severity rating of 7.8 (high).
How can I mitigate the vulnerability CVE-2021-36770?
To mitigate CVE-2021-36770, it is recommended to update to the fixed versions of Perl (above 5.36.0-9) and libencode-perl (above 3.19-1).