CVE-2024-14031 - Vulnerability Analysis

Overview

Sereal::Encoder 4.000 through 4.009_002 for Perl contains a buffer overflow caused by a race condition in the embedded Zstandard library's one-pass compression functions, letting attackers write bytes out of bounds, exploit requires use of smaller than recommended output buffer.

Severity & Score

Impact

Attackers can overwrite memory out of bounds, potentially leading to memory corruption or code execution.

Mitigation

Update to a version embedding Zstandard 1.3.8 or later, or upgrade to the latest Sereal::Encoder version.

References

• https://github.com/advisories/GHSA-w77f-wv46-4vcx
• https://metacpan.org/release/YVES/Sereal-Encoder-4.010/changes
• https://www.cve.org/CVERecord?id=CVE-2019-11922

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner