USN-8912-1: Perl DBI module vulnerabilities

Perl DBI versions before 1.653, which bundle the DBD::DBM driver, pass the dbm_type and dbm_mldbm connect attributes to Perl's require without validating that they name a module, enabling arbitrary module loading (CWE-470). An attacker who can influence either attribute, for example through a DSN fragment or an application parameter that selects a storage backend, can supply a path-shaped value that require treats as a literal filename (bypassing @INC), and the MLDBM::Serializer:: prefix prepended to dbm_mldbm does not stop traversal because only '::' separators are rewritten to '/'. Successful abuse runs the file-scope code of whatever file the value names, giving the attacker code execution on the host, typically by pointing the attribute at an attacker-controlled or pre-staged file. Any deployment of affected DBI versions that lets untrusted input set these attributes is at risk, with DBD::Gofer (which forwards connect attributes to the server side) and DBI::ProxyServer (which only checks that the DSN starts with a driver prefix) as notable exposure paths. No public proof-of-concept or in-the-wild exploitation is currently known.

Do: Upgrade to DBI 1.653 or later, which validates the dbm_type and dbm_mldbm attributes. Until then, never set these connect attributes from untrusted input, allowlist the permitted values server-side, and audit DBI::ProxyServer and DBD::Gofer deployments plus any code that builds a dbi:DBM DSN from user-controlled data.

Perl DBI before 1.654 incorrectly treats a numeric FetchHashKeyName attribute as a string. fetchrow_hashref uses that attribute's raw string pointer as the hash key name without stringifying it first, so an integer or floating-point value leaves an invalid pointer and the process crashes with a segmentation fault. The result is denial of service for the Perl process, not described as code execution, and only when the attribute is set to a non-string rather than a normal column-name mode. The flaw is in the widely deployed DBI database interface for Perl, in every version before 1.654. No public proof of concept is known and it is not listed in CISA KEV.

Do: Upgrade Perl DBI to version 1.654 or later and restart long-running Perl processes so they load the fixed module. Until then, set FetchHashKeyName only to a string (such as NAME, NAME_lc, or NAME_uc) and never to an integer or floating-point value, especially if that value can come from outside the application.