CVE-2024-14030 - Vulnerability Analysis

Overview

Sereal::Decoder 4.000 through 4.009_002 for Perl contains a buffer overflow caused by a race condition in the embedded Zstandard library's one-pass compression functions, letting attackers write out-of-bounds bytes, exploit requires crafted input triggering compression.

Severity & Score

Impact

Attackers can cause out-of-bounds memory writes, potentially leading to memory corruption or code execution.

Mitigation

Update to a version embedding Zstandard 1.3.8 or later, or upgrade to the latest Sereal::Decoder version.

References

• https://github.com/advisories/GHSA-w77f-wv46-4vcx
• https://metacpan.org/release/YVES/Sereal-Decoder-4.010/changes
• https://www.cve.org/CVERecord?id=CVE-2019-11922

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner