Read the docs
TI-2011-03172 Aliases CVE-2011-3597GHSA-42c5-x389-m7vp

Eval injection vulnerability in the Digest module before 1.17 for Perl allows…

Priority MEDIUM 47CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 7 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.

Why it matters now

EPSS 0.13054 96th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 7 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:gisle_aas:digest:1.00:*:*:*:*:*:*:*1.00VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.01:*:*:*:*:*:*:*1.01VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.02:*:*:*:*:*:*:*1.02VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.03:*:*:*:*:*:*:*1.03VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.04:*:*:*:*:*:*:*1.04VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.05:*:*:*:*:*:*:*1.05VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.06:*:*:*:*:*:*:*1.06VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.07:*:*:*:*:*:*:*1.07VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.08:*:*:*:*:*:*:*1.08VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.09:*:*:*:*:*:*:*1.09VulnerableGisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.00:*:*:*:*:*:*:* Versions 1.00 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.01:*:*:*:*:*:*:* Versions 1.01 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.02:*:*:*:*:*:*:* Versions 1.02 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.03:*:*:*:*:*:*:* Versions 1.03 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.04:*:*:*:*:*:*:* Versions 1.04 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.05:*:*:*:*:*:*:* Versions 1.05 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.06:*:*:*:*:*:*:* Versions 1.06 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.07:*:*:*:*:*:*:* Versions 1.07 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.08:*:*:*:*:*:*:* Versions 1.08 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.09:*:*:*:*:*:*:* Versions 1.09 Vulnerable ·Gisle Aas
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:gisle_aas:digest:1.10:*:*:*:*:*:*:*1.10VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.11:*:*:*:*:*:*:*1.11VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.12:*:*:*:*:*:*:*1.12VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.13:*:*:*:*:*:*:*1.13VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.14:*:*:*:*:*:*:*1.14VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.15:*:*:*:*:*:*:*1.15VulnerableGisle Aas
cpe:2.3:a:gisle_aas:digest:1.16:*:*:*:*:*:*:*1.16VulnerableGisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.13:*:*:*:*:*:*:* Versions 1.13 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.14:*:*:*:*:*:*:* Versions 1.14 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.15:*:*:*:*:*:*:* Versions 1.15 Vulnerable ·Gisle Aas
  • cpe:2.3:a:gisle_aas:digest:1.16:*:*:*:*:*:*:* Versions 1.16 Vulnerable ·Gisle Aas

Remediation

Red Hat 2 advisories

  • RHSA-2011:1797 Released 2011-12-08 · Red Hat rating Moderate
    perl security update
    • Red Hat Enterprise Linux (v. 5 server) perl-4:5.8.8-32.el5_7.6, perl-4:5.8.8-32.el5_7.6.i386, perl-4:5.8.8-32.el5_7.6.ia64 +5
    • Red Hat Enterprise Linux AS version 4 perl-3:5.8.5-57.el4, perl-3:5.8.5-57.el4.i386, perl-3:5.8.5-57.el4.ia64 +5
    • Red Hat Enterprise Linux Desktop (v. 5 client) perl-4:5.8.8-32.el5_7.6, perl-4:5.8.8-32.el5_7.6.i386, perl-suidperl-4:5.8.8-32.el5_7.6 +1
    • Red Hat Enterprise Linux Desktop version 4 perl-3:5.8.5-57.el4, perl-3:5.8.5-57.el4.i386, perl-suidperl-3:5.8.5-57.el4 +1
    • Red Hat Enterprise Linux ES version 4 perl-3:5.8.5-57.el4, perl-3:5.8.5-57.el4.i386, perl-3:5.8.5-57.el4.ia64 +3
    • Red Hat Enterprise Linux WS version 4 perl-3:5.8.5-57.el4, perl-3:5.8.5-57.el4.i386, perl-3:5.8.5-57.el4.ia64 +3
  • RHSA-2011:1424 Released 2011-11-03 · Red Hat rating Moderate
    perl security update
    • Red Hat Enterprise Linux Server (v. 6) perl-4:5.10.1-119.el6_1.1, perl-Archive-Extract-1:0.38-119.el6_1.1, perl-Archive-Tar-1.58-119.el6_1.1 +43

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Directory Server 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2011:1797
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:1797
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2011:1797
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:1797
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:1797
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:1424
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:1797

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-3597
  2. 2026-10-03 Alias added: GHSA-42c5-x389-m7vp

References

Patch 1

Advisory 5

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences