CVE-2017-20230

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2017-20230
Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.

10.0 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch Patch
https://github.com/Perl/perl5/issues/15831 Issue Tracking
https://metacpan.org/release/RURBAN/Storable-3.05/changes Release Notes
https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html Third Party Advisory
https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/04/21/5 Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:a:nwclark:storable:*:*:*:*:*:perl:*:*
History

22 Apr 2026, 17:36

Type Values Removed Values Added
References () https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch - () https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch - Patch
References () https://github.com/Perl/perl5/issues/15831 - () https://github.com/Perl/perl5/issues/15831 - Issue Tracking
References () https://metacpan.org/release/RURBAN/Storable-3.05/changes - () https://metacpan.org/release/RURBAN/Storable-3.05/changes - Release Notes
References () https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html - () https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html - Third Party Advisory
References () https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html - () https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html - Third Party Advisory
References () http://www.openwall.com/lists/oss-security/2026/04/21/5 - () http://www.openwall.com/lists/oss-security/2026/04/21/5 - Mailing List
CPE cpe:2.3:a:nwclark:storable:*:*:*:*:*:perl:*:*
First Time Nwclark
Nwclark storable

21 Apr 2026, 19:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/04/21/5 -

21 Apr 2026, 17:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 10.0

21 Apr 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-21 16:16

Updated : 2026-04-22 17:36

NVD link : CVE-2017-20230

Mitre link : CVE-2017-20230

CVE.ORG link : CVE-2017-20230

JSON object : View

Products Affected

nwclark

  • storable
CWE
CWE-121

Stack-based Buffer Overflow