CVE-2024-14030
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.36%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library. Sereal::Decoder embeds a version of the Zstandard (zstd) library that is vulnerable to CVE-2019-11922. This is a race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.36% probability · 29th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-787
- Affected
- yves/sereal\
- Source
- 9b29abf9-4ab0-4765-b253-1875cd9b441e
References
- https://github.com/advisories/GHSA-w77f-wv46-4vcxNot Applicable
- https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changesRelease Notes
- https://www.cve.org/CVERecord?id=CVE-2019-11922Not Applicable
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.