AI analysis
Versions 1.01 through 1.05 of the Perl CPAN distribution Crypt::SelfCertificate contain embedded malicious code (CWE-506) rather than a conventional software flaw. The module's generate_certificate function executes a Python script that ships disguised as a sample certificate file (lib/Crypt/SelfCertificate/sample/validate.p12 in 1.01, sample/cert7.pem in 1.05). That script decodes a base64-obfuscated, hardcoded HTTP URL, downloads whatever the server returns, and executes the response body directly, giving the attacker fileless arbitrary code execution with the privileges of the user who invoked the module. Anyone who installed these versions and called generate_certificate should assume attacker-controlled code may have run on their host. No CVSS score has been assigned, the issue is not on the CISA KEV list, and no public PoC or confirmed victim executions have been reported, though the malicious payload was distributed through the module's releases.
What to do: Uninstall Crypt::SelfCertificate 1.01–1.05 from all systems and replace it with a trusted, actively maintained certificate module or direct OpenSSL tooling. Treat any host that called generate_certificate with an affected version as potentially compromised: check for the advisory's SHA-256 hashes (e.g., Crypt-SelfCertificate-1.01.tar.gz fbff21f4..., Crypt-SelfCertificate-1.05.tar.gz 9fdfa7d6..., and the identical sample-file digest 27b2d2d3...), review egress logs for outbound HTTP connections to unfamiliar URLs, and rotate credentials used on those machines. Never open or execute the bundled sample files validate.p12 or cert7.pem.
Affected
| CPAN (Perl distribution, author unattributed in advisory) Crypt::SelfCertificate | 1.01 through 1.05 |
Estimated exposure
nicheunknown; likely tens to hundreds of downloads at most (obscure CPAN module, no published install counts) — No download or active-install statistics are published for this CPAN distribution; obscure Perl modules typically see negligible adoption, so exposure is almost certainly limited to a small number of developer and CI systems.
Description
Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly. The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host. The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation. For version 1.01, the dropper script is in lib/Crypt/SelfCertificate/sample/validate.p12. For version 1.05, the dropper script is in lib/Crypt/SelfCertificate/sample/cert7.pem. The SHA-256 digests of the files are fbff21f45ff748365062a5e36fb2d72558cad82a507a6f357f320b4fcdf07760 Crypt-SelfCertificate-1.01.tar.gz 27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc lib/Crypt/SelfCertificate/sample/validate.p12 9fdfa7d69b034b77d4510cda567e8da1e486ca81c7daaadc5732a45c41d71991 Crypt-SelfCertificate-1.05.tar.gz 27b2d2d3174ad771474fff2521f5084ec231e9218ea8c832515aef1cbd5897bc lib/Crypt/SelfCertificate/sample/cert7.pem