CVE-2017-20230

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Storable versions before 3.05 for Perl has a stack overflow.

The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-121

Affected software

Vendor	Product	Versions
NWCLARK	Storable	< 3.05

References

https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patchPatch
https://github.com/Perl/perl5/issues/15831Issue Tracking
https://metacpan.org/release/RURBAN/Storable-3.05/changesRelease Notes
https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.htmlThird Party Advisory
https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/21/5Mailing List

Timeline

Published: Apr 21, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2017

CVE-2017-202335.4Hirschmann HiLCOS products OpenBAT, BAT450, WLC, BAT867 contains a firewall filtering vulnerability that fails to correctly filter IPv4 mult CVE-2017-202349.8GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain u CVE-2017-202359.8ProSoft Technology ICX35-HWC version 1.3 and prior cellular gateways contain an authentication bypass vulnerability in the web user interfac CVE-2017-202369.8ProSoft Technology ICX35-HWC versions 1.3 and prior cellular gateways contain an input validation vulnerability in the web user interface th CVE-2017-202379.8Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service t CVE-2017-202387.1Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability th CVE-2017-202396.1MDwiki contains a cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by injecting malicious cod CVE-2017-202405.9Crypt::PBKDF2 versions before 0.261630 for Perl are vulnerable to timing attacks. These versions use Perl's built-in eq comparison. Discrep CVE-2017-202419.8Keysight IxChariot Endpoint before 9.5.102 contains a heap-based buffer overflow. An unauthenticated remote attacker can send a specially cr CVE-2017-202429.8Keysight IxChariot Endpoint before 9.5.102 contains a stack-based buffer overflow. An unauthenticated remote attacker can send a specially c CVE-2017-202438.2WordPress Car Park Booking Plugin version 13 October 17 contains a time-based SQL injection vulnerability that allows unauthenticated attack CVE-2017-202448.2Wow Forms WordPress Plugin version 2.1 contains an SQL injection vulnerability that allows unauthenticated attackers to read arbitrary datab