oss-security - Re: CVE Request: perl: denial-of-service / Regexp-matching "hangs" indefinitely on illegal input using binmode :utf8 using 100%CPU

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 20 Apr 2016 10:35:48 -0400 (EDT)
From: cve-assign@...re.org
To: carnil@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: perl: denial-of-service / Regexp-matching "hangs" indefinitely on illegal input using binmode :utf8 using 100%CPU

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> A bug in perl can cause regular expressions an malformed UTF8 inputs
> to go into a forever loop and consume 100% CPU. The issue was found to
> drive a realworld web application into an infinite loop
> 
> https://rt.perl.org/Public/Bug/Display.html?id=123562
> http://perl5.git.perl.org/perl.git/commit/22b433eff9a1ffa2454e18405a56650f07b385b5
> https://bugs.debian.org/821848

Use CVE-2015-8853 for all of 22b433eff9a1ffa2454e18405a56650f07b385b5.
We do not feel that there is enough information to pursue an
interpretation of "I did this also in the similar areas of regexec.c"
as requiring a separate CVE.

- -- 
CVE Assignment Team
M/S M300, 202 Burlington Road, Bedford, MA 01730 USA
[ A PGP key is available for encrypted communications at
  http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJXF5K9AAoJEHb/MwWLVhi2imAQAK01mTbjuVOPJ6g2APUntKXR
80XiAZQBnqCUO4Khnt399G1dyUgI4GrY0CzBvh34b6ecx37NP+OgZBsT+Jh+xQuA
EiiTiKb7foU7bf1R+b6aofyOiI0+ofG8i9i6fR/fSBcp93XHOTrWItc9H+W0Suiq
AjUUMOpr71daYsNmRq4rqscXI2TfSHHgzJ5rrEeO0/v3wru4RffxXfbNEIcR5soL
APjr/2AIWczHtZFKDeLZa0tGngrSrbN6Cx1psCw1zJ0ivAg5OX9l5dxHZMkI4nFt
Mn2fOHh5jMh5UIjaroxAxwTP9baN/Wh4HdROirSJrErM4k5LJzjjIJwaG3rE9mfr
9szFq+7zBjt7SlJEAOKiQrRNXYC1NM2SrKp3TXPI6KtREumuty0rH2kvv3xaoCut
Ne5aNxGnVni3zxUgul0UW/Z8+ObsGoM8HhiKPy2CU7lmllWIXVmRcNAzQaPrX1D4
owSBk2y1vgCkZ325BMgphUi82nFlqMMB+lb35KYbznhfPXwg0aSd7//9sIx3yYsJ
BmMMDZ/c5gkyXve3HHzgijMroJZnazTocvqXE9o8Y9eM4R/uOCuEa3c4KxkHuPgu
FKyWGbMZI8V0SlvMhhtXX3q+z77lTistWg0F1JA+eiIeBvBt3ZNFnuHpGUlasNZ3
KKhEY+5zhUgRcbGgYQn+
=/FX1
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.