Vulnerability-Lookup

oesa-2025-1631

Vulnerability from osv_openeuler

Published

2025-06-13 11:08

Modified

2026-08-06 11:08

Summary

perl security update

Details

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl threads have a working directory race condition where file operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.

This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.

The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6(CVE-2025-40909)

Severity

5.9 (Medium)


                    
                      CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2025-40909	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-5.28.3-11.oe2003sp4.aarch64.rpm",
          "perl-debuginfo-5.28.3-11.oe2003sp4.aarch64.rpm",
          "perl-debugsource-5.28.3-11.oe2003sp4.aarch64.rpm",
          "perl-devel-5.28.3-11.oe2003sp4.aarch64.rpm",
          "perl-libs-5.28.3-11.oe2003sp4.aarch64.rpm"
        ],
        "noarch": [
          "perl-help-5.28.3-11.oe2003sp4.noarch.rpm"
        ],
        "src": [
          "perl-5.28.3-11.oe2003sp4.src.rpm"
        ],
        "x86_64": [
          "perl-5.28.3-11.oe2003sp4.x86_64.rpm",
          "perl-debuginfo-5.28.3-11.oe2003sp4.x86_64.rpm",
          "perl-debugsource-5.28.3-11.oe2003sp4.x86_64.rpm",
          "perl-devel-5.28.3-11.oe2003sp4.x86_64.rpm",
          "perl-libs-5.28.3-11.oe2003sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:20.03-LTS-SP4",
        "name": "perl",
        "purl": "pkg:rpm/openEuler/perl\u0026distro=openEuler-20.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.28.3-11.oe2003sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-5.34.0-16.oe2203sp3.aarch64.rpm",
          "perl-debuginfo-5.34.0-16.oe2203sp3.aarch64.rpm",
          "perl-debugsource-5.34.0-16.oe2203sp3.aarch64.rpm",
          "perl-devel-5.34.0-16.oe2203sp3.aarch64.rpm",
          "perl-libs-5.34.0-16.oe2203sp3.aarch64.rpm"
        ],
        "noarch": [
          "perl-help-5.34.0-16.oe2203sp3.noarch.rpm"
        ],
        "src": [
          "perl-5.34.0-16.oe2203sp3.src.rpm"
        ],
        "x86_64": [
          "perl-5.34.0-16.oe2203sp3.x86_64.rpm",
          "perl-debuginfo-5.34.0-16.oe2203sp3.x86_64.rpm",
          "perl-debugsource-5.34.0-16.oe2203sp3.x86_64.rpm",
          "perl-devel-5.34.0-16.oe2203sp3.x86_64.rpm",
          "perl-libs-5.34.0-16.oe2203sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP3",
        "name": "perl",
        "purl": "pkg:rpm/openEuler/perl\u0026distro=openEuler-22.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.34.0-16.oe2203sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-5.34.0-14.oe2203sp4.aarch64.rpm",
          "perl-debuginfo-5.34.0-14.oe2203sp4.aarch64.rpm",
          "perl-debugsource-5.34.0-14.oe2203sp4.aarch64.rpm",
          "perl-devel-5.34.0-14.oe2203sp4.aarch64.rpm",
          "perl-libs-5.34.0-14.oe2203sp4.aarch64.rpm"
        ],
        "noarch": [
          "perl-help-5.34.0-14.oe2203sp4.noarch.rpm"
        ],
        "src": [
          "perl-5.34.0-14.oe2203sp4.src.rpm"
        ],
        "x86_64": [
          "perl-5.34.0-14.oe2203sp4.x86_64.rpm",
          "perl-debuginfo-5.34.0-14.oe2203sp4.x86_64.rpm",
          "perl-debugsource-5.34.0-14.oe2203sp4.x86_64.rpm",
          "perl-devel-5.34.0-14.oe2203sp4.x86_64.rpm",
          "perl-libs-5.34.0-14.oe2203sp4.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:22.03-LTS-SP4",
        "name": "perl",
        "purl": "pkg:rpm/openEuler/perl\u0026distro=openEuler-22.03-LTS-SP4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.34.0-14.oe2203sp4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-5.38.0-10.oe2403.aarch64.rpm",
          "perl-debuginfo-5.38.0-10.oe2403.aarch64.rpm",
          "perl-debugsource-5.38.0-10.oe2403.aarch64.rpm",
          "perl-devel-5.38.0-10.oe2403.aarch64.rpm",
          "perl-libs-5.38.0-10.oe2403.aarch64.rpm",
          "perl-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-debuginfo-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-debugsource-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-devel-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-libs-5.38.0-10.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "perl-help-5.38.0-10.oe2403.noarch.rpm",
          "perl-help-5.38.0-10.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "perl-5.38.0-10.oe2403.src.rpm",
          "perl-5.38.0-10.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "perl-5.38.0-10.oe2403.x86_64.rpm",
          "perl-debuginfo-5.38.0-10.oe2403.x86_64.rpm",
          "perl-debugsource-5.38.0-10.oe2403.x86_64.rpm",
          "perl-devel-5.38.0-10.oe2403.x86_64.rpm",
          "perl-libs-5.38.0-10.oe2403.x86_64.rpm",
          "perl-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-debuginfo-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-debugsource-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-devel-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-libs-5.38.0-10.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS",
        "name": "perl",
        "purl": "pkg:rpm/openEuler/perl\u0026distro=openEuler-24.03-LTS"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.38.0-10.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "aarch64": [
          "perl-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-debuginfo-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-debugsource-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-devel-5.38.0-10.oe2403sp1.aarch64.rpm",
          "perl-libs-5.38.0-10.oe2403sp1.aarch64.rpm"
        ],
        "noarch": [
          "perl-help-5.38.0-10.oe2403sp1.noarch.rpm"
        ],
        "src": [
          "perl-5.38.0-10.oe2403sp1.src.rpm"
        ],
        "x86_64": [
          "perl-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-debuginfo-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-debugsource-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-devel-5.38.0-10.oe2403sp1.x86_64.rpm",
          "perl-libs-5.38.0-10.oe2403sp1.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP1",
        "name": "perl",
        "purl": "pkg:rpm/openEuler/perl\u0026distro=openEuler-24.03-LTS-SP1"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.38.0-10.oe2403sp1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "Medium"
  },
  "details": "Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.\r\n\r\nSecurity Fix(es):\n\nPerl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone\u00a0that handle for the new thread, which is visible from any third (or\u00a0more) thread already running. \n\nThis may lead to unintended operations\u00a0such as loading code or accessing files from unexpected locations,\u00a0which a local attacker may be able to exploit.\n\nThe bug was introduced in commit\u00a011a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6(CVE-2025-40909)",
  "id": "OESA-2025-1631",
  "modified": "2026-08-06T11:08:43Z",
  "published": "2025-06-13T11:08:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1631"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40909"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "perl security update",
  "upstream": [
    "CVE-2025-40909"
  ]
}

CVE-2025-40909 (GCVE-0-2025-40909)

Vulnerability from cvelistv5 – Published: 2025-05-30 12:20 – Updated: 2026-04-18 14:15

Title

Perl threads have a working directory race condition where file operations may target unintended paths

Summary

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-05-30 14:05 UTC

CWE

CWE-689 - Permission Race Condition During Resource Copy
CWE-426 - Untrusted Search Path

Assigner

CPANSec redhat root

References

18 references

URL	Tags
https://github.com/Perl/perl5/commit/918bfff86ca8…	patch
https://www.openwall.com/lists/oss-security/2025/…	mailing-listexploit
https://github.com/Perl/perl5/issues/23010	issue-tracking
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug…	related
https://github.com/Perl/perl5/issues/10387	related
https://perldoc.perl.org/5.14.0/perl5136delta#Dir…	related
https://github.com/Perl/perl5/commit/11a11ecf4bea…	related
http://www.openwall.com/lists/oss-security/2025/05/23/1
http://www.openwall.com/lists/oss-security/2025/05/30/4
http://www.openwall.com/lists/oss-security/2025/06/02/2
http://www.openwall.com/lists/oss-security/2025/06/02/5
http://www.openwall.com/lists/oss-security/2025/06/02/6
http://www.openwall.com/lists/oss-security/2025/06/02/7
http://www.openwall.com/lists/oss-security/2025/06/03/1
http://seclists.org/fulldisclosure/2025/Sep/55
http://seclists.org/fulldisclosure/2025/Sep/54
http://seclists.org/fulldisclosure/2025/Sep/53
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

1 product

Vendor	Product	Version
perl	perl	Affected: 5.13.6 , < 5.41.13 (custom)

Credits

Vincent Lefevre

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-04-18T14:15:40.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/05/23/1"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/05/30/4"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/02/2"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/02/5"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/02/6"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/02/7"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2025/06/03/1"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/55"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/54"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2025/Sep/53"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 5.9,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-40909",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-30T14:05:00.839656Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-30T14:09:50.842Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "packageName": "perl",
          "product": "perl",
          "programRoutines": [
            {
              "name": "threads"
            }
          ],
          "repo": "https://github.com/perl/perl5",
          "vendor": "perl",
          "versions": [
            {
              "lessThan": "5.41.13",
              "status": "affected",
              "version": "5.13.6",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vincent Lefevre"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Perl threads have a working directory race condition where file operations may target unintended paths.\u003cbr\u003e\u003cbr\u003eIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone\u0026nbsp;that handle for the new thread, which is visible from any third (or\u0026nbsp;more) thread already running. \u003cbr\u003e\u003cbr\u003eThis may lead to unintended operations\u0026nbsp;such as loading code or accessing files from unexpected locations,\u0026nbsp;which a local attacker may be able to exploit.\u003cbr\u003e\u003cbr\u003eThe bug was introduced in commit\u0026nbsp;11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"
            }
          ],
          "value": "Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone\u00a0that handle for the new thread, which is visible from any third (or\u00a0more) thread already running. \n\nThis may lead to unintended operations\u00a0such as loading code or accessing files from unexpected locations,\u00a0which a local attacker may be able to exploit.\n\nThe bug was introduced in commit\u00a011a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-689",
              "description": "CWE-689 Permission Race Condition During Resource Copy",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-05T13:24:00.827Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch"
        },
        {
          "tags": [
            "mailing-list",
            "exploit"
          ],
          "url": "https://www.openwall.com/lists/oss-security/2025/05/22/2"
        },
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/Perl/perl5/issues/23010"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/Perl/perl5/issues/10387"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Update perl to an unaffected version, or apply the patch provided in the references section."
            }
          ],
          "value": "Update perl to an unaffected version, or apply the patch provided in the references section."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Perl threads have a working directory race condition where file operations may target unintended paths",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2025-40909",
    "datePublished": "2025-05-30T12:20:11.237Z",
    "dateReserved": "2025-04-16T09:05:34.360Z",
    "dateUpdated": "2026-04-18T14:15:40.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.