CVE-2011-3597

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-01-13 · updated 2026-06-16
Weakness: CWE-20

Description

Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.

Affected products

Gisle Aas Digest: 1.00, 1.01, 1.02, 1.03, 1.04, 1.05 (+11)

References

http://aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc
http://cpansearch.perl.org/src/GAAS/Digest-1.17/Changes
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
http://secunia.com/advisories/46279
http://secunia.com/advisories/51457
http://www.mandriva.com/security/advisories?name=MDVSA-2012:008
http://www.mandriva.com/security/advisories?name=MDVSA-2012:009
http://www.redhat.com/support/errata/RHSA-2011-1424.html
http://www.redhat.com/support/errata/RHSA-2011-1797.html
http://www.securityfocus.com/bid/49911
http://www.ubuntu.com/usn/USN-1643-1

Get alerted when CVE-2011-3597 or the next vulnerability affects your stack