CVE-2023-47038

A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 29%
Affected Products (NVD)
VendorProductVersion
perlperl
5.30.0 ≤
𝑥
≤ 5.38.0
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
redhatenterprise_linux_aus
9.4
redhatenterprise_linux_eus
9.4
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
perl
bookworm
5.36.0-7+deb12u1
fixed
bullseye
5.32.1-4+deb11u3
fixed
bullseye (security)
5.32.1-4+deb11u4
fixed
buster
not-affected
sid
5.40.0-8
fixed
trixie
5.40.0-8
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
perl
bionic
not-affected
focal
Fixed 5.30.0-9ubuntu0.5
released
jammy
Fixed 5.34.0-3ubuntu1.3
released
lunar
Fixed 5.36.0-7ubuntu0.23.04.2
released
mantic
Fixed 5.36.0-9ubuntu1.1
released
noble
Fixed 5.36.0-10ubuntu1
released
oracular
Fixed 5.36.0-10ubuntu1
released
trusty
not-affected
xenial
not-affected
perl6
bionic
needs-triage
focal
needs-triage
jammy
dne
lunar
dne
mantic
dne
noble
dne
oracular
dne
trusty
ignored
xenial
ignored
raku
bionic
ignored
focal
dne
jammy
dne
lunar
ignored
mantic
ignored
noble
needs-triage
oracular
needs-triage
trusty
ignored
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
perl
RHEL 9
4:5.32.1-481.el9
fixed
perl-Attribute-Handlers
RHEL 9
0:1.01-481.el9
fixed
perl-AutoLoader
RHEL 9
0:5.74-481.el9
fixed
perl-AutoSplit
RHEL 9
0:5.74-481.el9
fixed
perl-B
RHEL 9
0:1.80-481.el9
fixed
perl-Benchmark
RHEL 9
0:1.23-481.el9
fixed
perl-Class-Struct
RHEL 9
0:0.66-481.el9
fixed
perl-Config-Extensions
RHEL 9
0:0.03-481.el9
fixed
perl-DBM
RHEL 9
0:0.06-481.el9
fixed
perl-Devel-Peek
RHEL 9
0:1.28-481.el9
fixed
perl-Devel-SelfStubber
RHEL 9
0:1.06-481.el9
fixed
perl-DirHandle
RHEL 9
0:1.05-481.el9
fixed
perl-Dumpvalue
RHEL 9
0:2.27-481.el9
fixed
perl-DynaLoader
RHEL 9
0:1.47-481.el9
fixed
perl-English
RHEL 9
0:1.11-481.el9
fixed
perl-Errno
RHEL 9
0:1.30-481.el9
fixed
perl-ExtUtils-Constant
RHEL 9
0:0.25-481.el9
fixed
perl-ExtUtils-Embed
RHEL 9
0:1.35-481.el9
fixed
perl-ExtUtils-Miniperl
RHEL 9
0:1.09-481.el9
fixed
perl-Fcntl
RHEL 9
0:1.13-481.el9
fixed
perl-File-Basename
RHEL 9
0:2.85-481.el9
fixed
perl-File-Compare
RHEL 9
0:1.100.600-481.el9
fixed
perl-File-Copy
RHEL 9
0:2.34-481.el9
fixed
perl-File-DosGlob
RHEL 9
0:1.12-481.el9
fixed
perl-File-Find
RHEL 9
0:1.37-481.el9
fixed
perl-File-stat
RHEL 9
0:1.09-481.el9
fixed
perl-FileCache
RHEL 9
0:1.10-481.el9
fixed
perl-FileHandle
RHEL 9
0:2.03-481.el9
fixed
perl-FindBin
RHEL 9
0:1.51-481.el9
fixed
perl-GDBM
RHEL 9
0:1.18-481.el9
fixed
perl-Getopt-Std
RHEL 9
0:1.12-481.el9
fixed
perl-Hash-Util
RHEL 9
0:0.23-481.el9
fixed
perl-Hash-Util-FieldHash
RHEL 9
0:1.20-481.el9
fixed
perl-I18N-Collate
RHEL 9
0:1.02-481.el9
fixed
perl-I18N-LangTags
RHEL 9
0:0.44-481.el9
fixed
perl-I18N-Langinfo
RHEL 9
0:0.19-481.el9
fixed
perl-IO
RHEL 9
0:1.43-481.el9
fixed
perl-IPC-Open3
RHEL 9
0:1.21-481.el9
fixed
perl-Locale-Maketext-Simple
RHEL 9
1:0.21-481.el9
fixed
perl-Math-Complex
RHEL 9
0:1.59-481.el9
fixed
perl-Memoize
RHEL 9
0:1.03-481.el9
fixed
perl-Module-Loaded
RHEL 9
1:0.08-481.el9
fixed
perl-NDBM
RHEL 9
0:1.15-481.el9
fixed
perl-NEXT
RHEL 9
0:0.67-481.el9
fixed
perl-Net
RHEL 9
0:1.02-481.el9
fixed
perl-ODBM
RHEL 9
0:1.16-481.el9
fixed
perl-Opcode
RHEL 9
0:1.48-481.el9
fixed
perl-POSIX
RHEL 9
0:1.94-481.el9
fixed
perl-Pod-Functions
RHEL 9
0:1.13-481.el9
fixed
perl-Pod-Html
RHEL 9
0:1.25-481.el9
fixed
perl-Safe
RHEL 9
0:2.41-481.el9
fixed
perl-Search-Dict
RHEL 9
0:1.07-481.el9
fixed
perl-SelectSaver
RHEL 9
0:1.02-481.el9
fixed
perl-SelfLoader
RHEL 9
0:1.26-481.el9
fixed
perl-Symbol
RHEL 9
0:1.08-481.el9
fixed
perl-Sys-Hostname
RHEL 9
0:1.23-481.el9
fixed
perl-Term-Complete
RHEL 9
0:1.403-481.el9
fixed
perl-Term-ReadLine
RHEL 9
0:1.17-481.el9
fixed
perl-Test
RHEL 9
0:1.31-481.el9
fixed
perl-Text-Abbrev
RHEL 9
0:1.02-481.el9
fixed
perl-Thread
RHEL 9
0:3.05-481.el9
fixed
perl-Thread-Semaphore
RHEL 9
0:2.13-481.el9
fixed
perl-Tie
RHEL 9
0:4.6-481.el9
fixed
perl-Tie-File
RHEL 9
0:1.06-481.el9
fixed
perl-Tie-Memoize
RHEL 9
0:1.1-481.el9
fixed
perl-Time
RHEL 9
0:1.03-481.el9
fixed
perl-Time-Piece
RHEL 9
0:1.3401-481.el9
fixed
perl-Unicode-UCD
RHEL 9
0:0.75-481.el9
fixed
perl-User-pwent
RHEL 9
0:1.03-481.el9
fixed
perl-autouse
RHEL 9
0:1.11-481.el9
fixed
perl-base
RHEL 9
0:2.27-481.el9
fixed
perl-blib
RHEL 9
0:1.07-481.el9
fixed
perl-debugger
RHEL 9
0:1.56-481.el9
fixed
perl-deprecate
RHEL 9
0:0.04-481.el9
fixed
perl-devel
RHEL 9
4:5.32.1-481.el9
fixed
perl-diagnostics
RHEL 9
0:1.37-481.el9
fixed
perl-doc
RHEL 9
0:5.32.1-481.el9
fixed
perl-encoding-warnings
RHEL 9
0:0.13-481.el9
fixed
perl-fields
RHEL 9
0:2.27-481.el9
fixed
perl-filetest
RHEL 9
0:1.03-481.el9
fixed
perl-if
RHEL 9
0:0.60.800-481.el9
fixed
perl-interpreter
RHEL 9
4:5.32.1-481.el9
fixed
perl-less
RHEL 9
0:0.03-481.el9
fixed
perl-lib
RHEL 9
0:0.65-481.el9
fixed
perl-libnetcfg
RHEL 9
4:5.32.1-481.el9
fixed
perl-libs
RHEL 9
4:5.32.1-481.el9
fixed
perl-locale
RHEL 9
0:1.09-481.el9
fixed
perl-macros
RHEL 9
4:5.32.1-481.el9
fixed
perl-meta-notation
RHEL 9
0:5.32.1-481.el9
fixed
perl-mro
RHEL 9
0:1.23-481.el9
fixed
perl-open
RHEL 9
0:1.12-481.el9
fixed
perl-overload
RHEL 9
0:1.31-481.el9
fixed
perl-overloading
RHEL 9
0:0.02-481.el9
fixed
perl-ph
RHEL 9
0:5.32.1-481.el9
fixed
perl-sigtrap
RHEL 9
0:1.09-481.el9
fixed
perl-sort
RHEL 9
0:2.04-481.el9
fixed
perl-subs
RHEL 9
0:1.03-481.el9
fixed
perl-utils
RHEL 9
0:5.32.1-481.el9
fixed
perl-vars
RHEL 9
0:1.05-481.el9
fixed
perl-vmsish
RHEL 9
0:1.04-481.el9
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2024:2228
https://access.redhat.com/errata/RHSA-2024:3128
https://access.redhat.com/security/cve/CVE-2023-47038
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746
https://bugzilla.redhat.com/show_bug.cgi?id=2249523
https://access.redhat.com/errata/RHSA-2024:2228
https://access.redhat.com/errata/RHSA-2024:3128
https://access.redhat.com/security/cve/CVE-2023-47038
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1056746
https://bugzilla.redhat.com/show_bug.cgi?id=2249523
https://github.com/Perl/perl5/commit/12c313ce49b36160a7ca2e9b07ad5bd92ee4a010
https://github.com/Perl/perl5/commit/7047915eef37fccd93e7cd985c29fe6be54650b6
https://github.com/Perl/perl5/commit/ff1f9f59360afeebd6f75ca1502f5c3ebf077da3
https://github.com/aquasecurity/trivy/discussions/8400
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNEEWAACXQCEEAKSG7XX2D5YDRWLCIZJ/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UMDZZ4SCEW6FRWZDMXGAKZ35THTAWFG6/
https://perldoc.perl.org/perl5382delta#CVE-2023-47038-Write-past-buffer-end-via-illegal-user-defined-Unicode-property
https://ubuntu.com/security/CVE-2023-47100
https://www.suse.com/security/cve/CVE-2023-47100.html