CVE-2021-36770

HIGH

p5-encode 3.05-3.11 - Uncontrolled Search Path Element via Encode::ConfigLocal Library

Title source: llm
STIX 2.1

Description

Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.

References (9)

Core 9
Core References
Third Party Advisory x_refsource_confirm
https://metacpan.org/dist/Encode/changes
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2021-36770
Third Party Advisory x_refsource_confirm
https://news.cpanel.com/unscheduled-tsr-10-august-2021/
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210909-0003/

Scores

CVSS v3 7.8
EPSS 0.0011
EPSS Percentile 28.9%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-427
Status published
Products (3)
fedoraproject/fedora 34
fedoraproject/fedora 33
p5-encode_project/p5-encode 3.05 - 3.12
Published Aug 11, 2021
Tracked Since Feb 18, 2026