Executive brief
Sereal::Decoder, a Perl library used for high-performance data deserialization, contains a security flaw due to an outdated internal component. This vulnerability could allow an attacker to cause a system crash or potentially execute unauthorized code by sending specially crafted compressed data. Organizations using this library for processing external data are at risk of service disruptions or data compromise.
Technical details
Sereal::Decoder versions 4.000 through 4.009_002 embed an outdated version of the Zstandard (zstd) library (prior to 1.3.8) which is susceptible to CVE-2019-11922. The vulnerability is a race condition within the one-pass compression functions that occurs when an output buffer smaller than the recommended size is utilized. A remote attacker can exploit this to trigger an out-of-bounds write, potentially leading to memory corruption, denial of service, or arbitrary code execution. The issue is resolved in Sereal::Decoder version 4.010, which updates the embedded zstd dependency.
Affected products
- YVES Sereal::Decoder 4.000 - 4.009_002
Timeline
- 2019-07-25: advisory: Original Zstandard vulnerability (CVE-2019-11922) disclosed
- 2024-03-31: disclosed: CVE-2024-14030 assigned to Sereal::Decoder for embedding the vulnerable library
- 2024-03-31: patched: Sereal::Decoder version 4.010 released to address the issue