CVE-2011-10007

Name	CVE-2011-10007
Description	File::Find::Rule through 0.34 for Perl is vulnerable to Arbitrary Code Execution when `grep()` encounters a crafted filename. A file handle is opened with the 2 argument form of `open()` allowing an attacker controlled filename to provide the MODE parameter to `open()`, turning the filename into a command to be executed. Example: $ mkdir /tmp/poc; echo > "/tmp/poc/\|id" $ perl -MFile::Find::Rule \ -E 'File::Find::Rule->grep("foo")->in("/tmp/poc")' uid=1000(user) gid=1000(user) groups=1000(user),100(users)
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4209-1, DSA-5936-1
Debian Bugs	1107311

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libfile-find-rule-perl (PTS)	bullseye	0.34-1	vulnerable
	bullseye (security)	0.34-1+deb11u1	fixed
	bookworm (security)	0.34-4~deb12u1	fixed
	trixie, bookworm	0.34-3	vulnerable
	sid	0.34-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
libfile-find-rule-perl	source	bullseye	0.34-1+deb11u1	DLA-4209-1
libfile-find-rule-perl	source	bookworm	0.34-4~deb12u1	DSA-5936-1
libfile-find-rule-perl	source	(unstable)	0.34-4		1107311

Notes

https://lists.security.metacpan.org/cve-announce/msg/30183067/
https://rt.cpan.org/Public/Bug/Display.html?id=64504
https://github.com/richardc/perl-file-find-rule/pull/4
Fixed by: https://github.com/richardc/perl-file-find-rule/commit/df58128bcee4c1da78c34d7f3fe1357e575ad56f