Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale.
Voir CVE-2026-64193 →
DEBIAN-CVE-2026-64193
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parse...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option (RFC 8914) by tokenising the raw bytes and passing the result to Perl's eval. There is some escaping done for $ and @, but not for backticks. This can be exploited for command execution if $pkt->edns->option('EXTENDED-ERROR') is called in array context, for example with a payload of {0:""} in EXTRA-TEXT.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Paquets affectés
Debian:13
libnet-dns-perl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-0+deb13u1"}]}]
Debian:14
libnet-dns-perl
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.56-1"}]}]
Références
- advisory security-tracker.debian.org