CVE-2017-20230

Published: Apr 21, 2026Modified: Apr 22, 2026

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.

Affected (1)

Products: Nwclark: Storable

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nwclark Storable	Before 3.05

Related CWEs

Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References (6)

https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Patch

https://github.com/Perl/perl5/issues/15831

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Issue Tracking

https://metacpan.org/release/RURBAN/Storable-3.05/changes

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Release Notes

https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party Advisory

https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html

Source: 9b29abf9-4ab0-4765-b253-1875cd9b441e

Third Party Advisory

http://www.openwall.com/lists/oss-security/2026/04/21/5

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing List

Timeline

No history available yet.