A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - perl: Write past buffer end via illegal user-defined Unicode property (CVE-2023-47038)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-3128 advisory.

    perl-Algorithm-Diff     perl-Archive-Tar     perl-Archive-Zip     perl-autodie     perl-bignum     perl-Carp     perl-Compress-Bzip2     perl-Compress-Raw-Bzip2     perl-Compress-Raw-Lzma     perl-Compress-Raw-Zlib     [2.096-2]
    - Fix test broken by update in zlib on s390x
    - Related: RHEL-16371

    perl-Config-Perl-V     perl-constant     perl-CPAN-DistnameInfo     perl-CPAN-Meta     perl-CPAN-Meta-Requirements     perl-CPAN-Meta-YAML     perl-CPAN     perl-Data-Dumper     perl-Data-OptList     perl-Data-Section     perl-DB_File     perl-Devel-PPPort     perl-Devel-Size     perl-Digest-MD5     perl-Digest     perl-Digest-SHA     perl-Encode-Locale     perl-Encode     perl-Env     perl-experimental     perl-Exporter     perl-ExtUtils-CBuilder     perl-ExtUtils-Install     perl-ExtUtils-MakeMaker     perl-ExtUtils-Manifest     perl-ExtUtils-ParseXS     perl-Fedora-VSP     perl-File-Fetch     perl-File-HomeDir     perl-File-Path     perl-File-Temp     perl-File-Which     perl-Filter     perl-Filter-Simple     perl-generators     perl-Getopt-Long     perl-HTTP-Tiny     perl-Importer     perl-inc-latest     perl-IO-Compress-Lzma     perl-IO-Compress     perl-IO-Socket-IP     perl-IPC-Cmd     perl-IPC-System-Simple     perl-IPC-SysV     perl-JSON-PP     perl-libnet     perl-Locale-Maketext     perl-local-lib     perl-Math-BigInt-FastCalc     perl-Math-BigInt     perl-Math-BigRat     perl-MIME-Base64     perl-Module-Build     perl-Module-CoreList     perl-Module-Load-Conditional     perl-Module-Load     perl-Module-Metadata     perl-MRO-Compat     perl-Object-HashBase     perl-Package-Generator     perl-Params-Check     perl-Params-Util     perl-parent     perl-PathTools     perl     [4:5.32.1-473]
    - Fix CVE-2023-47038
    - Added perl-autouse and perl-ExtUtils-MM-Utils to perl run-requires

    perl-perlfaq     perl-PerlIO-via-QuotedPrint     perl-Perl-OSType     perl-Pod-Checker     perl-Pod-Escapes     perl-podlators     perl-Pod-Parser     perl-Pod-Perldoc     perl-Pod-Simple     perl-Pod-Usage     perl-Scalar-List-Utils     perl-Socket     perl-Software-License     perl-Storable     perl-Sub-Exporter     perl-Sub-Install     perl-Sys-Syslog     perl-Term-ANSIColor     perl-Term-Cap     perl-Term-Table     perl-Test-Harness     perl-Test-Simple     perl-Text-Balanced     perl-Text-Diff     perl-Text-Glob     perl-Text-ParseWords     perl-Text-Tabs+Wrap     perl-Text-Template     perl-Thread-Queue     perl-threads     perl-threads-shared     perl-Time-HiRes     perl-Time-Local     perl-Unicode-Collate     perl-Unicode-Normalize     perl-URI     perl-version

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:3128 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Write past buffer end via illegal user-defined Unicode property (CVE-2023-47038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2228 advisory.

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:2228 advisory.

    Perl is a high-level programming language that is commonly used for system administration utilities and     web programming.

    Security Fix(es):

    * perl: Write past buffer end via illegal user-defined Unicode property (CVE-2023-47038)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The versions of Oracle Database Server installed on the remote host are affected by multiple vulnerabilities as referenced in the April 2024 CPU advisory.

  - Vulnerability in the RDBMS (Python) component of Oracle Database Server. Supported versions that are     affected are 21.3-21.13. Easily exploitable vulnerability allows low privileged attacker having     Authenticated User privilege with network access via Oracle Net to compromise RDBMS (Python). Successful     attacks require human interaction from a person other than the attacker. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS)     of RDBMS (Python). (CVE-2023-36632) 

  - Vulnerability in the Grid Infrastructure (Apache Mina SSHD) component of Oracle Database Server.   Supported versions that are affected are 21.3-21.13. Difficult to exploit vulnerability allows   unauthenticated attacker with network access via SSH to compromise Grid Infrastructure (Apache Mina SSHD).   Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification   access to critical data or all Grid Infrastructure (Apache Mina SSHD) accessible data. (CVE-2023-48795)

  - Vulnerability in the Oracle SQLcl (Apache Mina SSHD) component of Oracle Database Server. Supported   versions that are affected are 19.3-19.22 and 21.3-21.13. Difficult to exploit vulnerability allows   unauthenticated attacker with network access via SSH to compromise Oracle SQLcl (Apache Mina SSHD).   Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification   access to critical data or all Oracle SQLcl (Apache Mina SSHD) accessible data. (CVE-2023-48795)	

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the perl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

  - In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the perl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

  - In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Fedora 38 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-9ef8a60a05 advisory.

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2023-448 advisory.

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

  - In Perl before 5.38.2, S_parse_uniprop_string in regcomp.c can write to unallocated space because a     property name associated with a \p{...} regular expression construct is mishandled. The earliest affected     version is 5.30.0. (CVE-2023-47100)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-c67f4dbf13 advisory.

  - A vulnerability was found in perl. This issue occurs when a crafted regular expression is compiled by     perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
    (CVE-2023-47038)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6517-1 advisory.

  - In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code     execution or local privilege escalation. (CVE-2022-48522)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199761	RHEL 8 : 5.30_perl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
198025	Oracle Linux 8 : perl:5.32 (ELSA-2024-3128)	Nessus	Oracle Linux Local Security Checks	high
197803	RHEL 8 : perl:5.32 (RHSA-2024:3128)	Nessus	Red Hat Local Security Checks	high
195048	Oracle Linux 9 : perl (ELSA-2024-2228)	Nessus	Oracle Linux Local Security Checks	high
194795	RHEL 9 : perl (RHSA-2024:2228)	Nessus	Red Hat Local Security Checks	high
193497	Oracle Database Server (Apr 2024 CPU)	Nessus	Databases	critical
192343	EulerOS Virtualization 2.11.0 : perl (EulerOS-SA-2024-1446)	Nessus	Huawei Local Security Checks	critical
192337	EulerOS Virtualization 2.11.1 : perl (EulerOS-SA-2024-1418)	Nessus	Huawei Local Security Checks	critical
189702	EulerOS 2.0 SP11 : perl (EulerOS-SA-2024-1126)	Nessus	Huawei Local Security Checks	critical
189685	EulerOS 2.0 SP11 : perl (EulerOS-SA-2024-1110)	Nessus	Huawei Local Security Checks	critical
187039	Fedora 38 : perl / perl-Devel-Cover / perl-PAR-Packer / polymake (2023-9ef8a60a05)	Nessus	Fedora Local Security Checks	high
186976	Amazon Linux 2023 : perl, perl-Attribute-Handlers, perl-AutoLoader (ALAS2023-2023-448)	Nessus	Amazon Linux Local Security Checks	critical
186603	Fedora 39 : perl / perl-Devel-Cover / perl-PAR-Packer / polymake (2023-c67f4dbf13)	Nessus	Fedora Local Security Checks	high
186300	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Perl vulnerabilities (USN-6517-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2023-47038

high

Tenable Plugins

high

high

high

high

high

critical

critical

critical

critical

critical

high

critical

high

critical