CVE-2020-12723

HIGH EPSS 92.4%
Published Jun 5, 20206y ago · Modified Jun 17, 20262w ago
7.5 CVSS 3.1
High
Find Similar
Published Jun 5, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

regcomp.c in Perl before 5.30.3 allows a buffer overflow via a crafted regular expression because of recursive S_study_chunk calls.

CVSS Details

Base Score
7.5
Exploitability
3.9
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
92.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-120

Affected Products 21

VendorProductVersionRange
perlperl* <5.30.3
netapponcommand_workflow_automation*any
netappsnap_creator_framework*any
fedoraprojectfedora31any
opensuseleap15.1any
oraclecommunications_billing_and_revenue_management12.0.0.2.0any
oraclecommunications_billing_and_revenue_management12.0.0.3.0any
oraclecommunications_diameter_signaling_router*≥8.0.0  –  ≤8.5.0
oraclecommunications_eagle_application_processor*≥16.1.0  –  ≤16.4.0
oraclecommunications_eagle_lnp_application_processor10.1any
oraclecommunications_eagle_lnp_application_processor10.2any
oraclecommunications_lsms*≥13.1  –  ≤13.4
oraclecommunications_offline_mediation_controller12.0.0.3.0any
oraclecommunications_performance_intelligence_center*≥10.3.0.0.0  –  ≤10.3.0.2.1
oraclecommunications_performance_intelligence_center*≥10.4.0.1.0  –  ≤10.4.0.3.1
oracleconfiguration_manager12.1.2.0.8any
oracleenterprise_manager_base_platform13.4.0.0any
oraclesd-wan_edge8.2any
oraclesd-wan_edge9.0any
oraclesd-wan_edge9.1any
oracletekelec_platform_distribution*≥7.4.0  –  ≤7.7.1

References 16

  • lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00044.html
    Mailing ListThird Party Advisory
  • github.com https://github.com/Perl/perl5/blob/blead/pod/perl5303delta.pod
    Third Party Advisory
  • github.com https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
    PatchThird Party Advisory
  • github.com https://github.com/Perl/perl5/issues/16947
    Third Party Advisory
  • github.com https://github.com/Perl/perl5/issues/17743
    Third Party Advisory
  • github.com https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a
    PatchThird Party Advisory
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IN3TTBO5KSGWE5IRIKDJ5JSQRH7ANNXE/
  • security.gentoo.org https://security.gentoo.org/glsa/202006-03
    Third Party Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20200611-0001/
    Third Party Advisory
  • oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2021.html
    PatchThird Party Advisory

Remediation

  • github.com https://github.com/Perl/perl5/compare/v5.30.2...v5.30.3
    PatchThird Party Advisory
  • github.com https://github.com/perl/perl5/commit/66bbb51b93253a3f87d11c2695cfb7bdb782184a
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com//security-alerts/cpujul2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuApr2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuapr2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2021.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpujan2022.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2020.html
    PatchThird Party Advisory
  • oracle.com https://www.oracle.com/security-alerts/cpuoct2021.html
    PatchThird Party Advisory