CVE-2020-12723

moderate-risk
Published 2020-06-05

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Communications Eagle Application Processor
Communications Eagle Lnp Application Processor
Communications Eagle Lnp Application Processor
Communications Lsms
Tekelec Platform Distribution

Affected Vendors

Oracle Perl Fedoraproject Netapp Opensuse

References (32)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
Third Party Advisory https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
Patch https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
Third Party Advisory https://github.com/Perl/perl5/issues/16947
Third Party Advisory https://github.com/Perl/perl5/issues/17743
Patch https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
Third Party Advisory https://security.gentoo.org/glsa/202006-03
Third Party Advisory https://security.netapp.com/advisory/ntap-20200611-0001/
Patch https://www.oracle.com//security-alerts/cpujul2021.html
Patch https://www.oracle.com/security-alerts/cpuApr2021.html
Patch https://www.oracle.com/security-alerts/cpuapr2022.html
Patch https://www.oracle.com/security-alerts/cpujan2021.html
Patch https://www.oracle.com/security-alerts/cpujan2022.html
Patch https://www.oracle.com/security-alerts/cpuoct2020.html
Patch https://www.oracle.com/security-alerts/cpuoct2021.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
Third Party Advisory https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
Patch https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
Third Party Advisory https://github.com/Perl/perl5/issues/16947
and 12 more references
47
/ 100
moderate-risk
Severity 26/34 · High
Exploitability 1/34 · Minimal
Exposure 20/34 · Moderate