openSUSE-SU-2023:0225-1 Security update for perl-Cpanel-JSON-XS
A memory corruption vulnerability in the Perl Cpanel-JSON-XS library allows attackers to execute arbitrary code or cause denial of service via crafted JSON input.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is openSUSE-SU-2023:0225-1?
openSUSE-SU-2023:0225-1 is a memory corruption vulnerability in perl-Cpanel-JSON-XS, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
This update for perl-Cpanel-JSON-XS fixes the following issues:
perl-Cpanel-JSON-XS was updated to 4.36
see /usr/share/doc/packages/perl-Cpanel-JSON-XS/Changes
4.36 2023-03-02 (rurban)
- remove the SAVESTACK_POS noop. Merged from JSON-XS-3.02, removed there with 4.0. requested to remove with L<https://github.com/Perl/perl5/pull/20858>
4.35 2023-02-22 (rurban)
- fix utf8 object stringification (jixam PR #212)
4.34 2023-02-21 (rurban)
- fix c89 compilation regression, for loop init on centos. GH #211
4.33 2023-02-21 (rurban)
- fix a security issue, decoding hash keys without ending : (GH #208)
- check all bare hash keys for utf8 (GH #209)
- improve overload warnings (Graham Knop PR #205)
- fix a croak leak (GH #206)
Which versions are affected by openSUSE-SU-2023:0225-1?
Linux distribution packages (2)
perl-Cpanel-JSON-XS SUSE:Package Hub 15 SP5 | All versions | 4.36-bp155.2.3.1 |
perl-Cpanel-JSON-XS openSUSE:Leap 15.5 | All versions | 4.36-bp155.2.3.1 |
How do I fix openSUSE-SU-2023:0225-1?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is openSUSE-SU-2023:0225-1 being exploited?
There is no known exploitation of openSUSE-SU-2023:0225-1 in the wild and no public exploit code.