CVE-2011-3597
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent...
7.5 HighPublic exploitFix available
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
Exploit likelihood
13.1%Up 0.1 points since Feb 4, 2022
What each source reports
NVD Score used
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
- Record
CVE-2011-3597- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
- Record
CVE-2011-3597- Updated
- 2026-11-02
EUVDEUVD-2011-3556 No score
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
- Record
EUVD-2011-3556- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-42c5-x389-m7vp No score
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent...
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
- Record
GHSA-42c5-x389-m7vp- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
- Record
CVE-2011-3597- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-3597 No score
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.
- Record
DEBIAN-CVE-2011-3597- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perlDebian:12 |
before 5.12.4-6 | 5.12.4-6 |
perlDebian:13 |
before 5.12.4-6 | 5.12.4-6 |
perlDebian:14 |
before 5.12.4-6 | 5.12.4-6 |
perlRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-Archive-ExtractRed Hat:enterprise_linux:6::server |
before 1:0.38-119.el6_1.1 | 1:0.38-119.el6_1.1 |
perl-Archive-TarRed Hat:enterprise_linux:6::server |
before 0:1.58-119.el6_1.1 | 0:1.58-119.el6_1.1 |
perl-CGIRed Hat:enterprise_linux:6::server |
before 0:3.51-119.el6_1.1 | 0:3.51-119.el6_1.1 |
perl-CPANRed Hat:enterprise_linux:6::server |
before 0:1.9402-119.el6_1.1 | 0:1.9402-119.el6_1.1 |
perl-CPANPLUSRed Hat:enterprise_linux:6::server |
before 0:0.88-119.el6_1.1 | 0:0.88-119.el6_1.1 |
perl-Compress-Raw-ZlibRed Hat:enterprise_linux:6::server |
before 0:2.023-119.el6_1.1 | 0:2.023-119.el6_1.1 |
Show 56 moreShow less
| Package | Affected | Fixed |
|---|---|---|
perl-Compress-ZlibRed Hat:enterprise_linux:6::server |
before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-Digest-SHARed Hat:enterprise_linux:6::server |
before 1:5.47-119.el6_1.1 | 1:5.47-119.el6_1.1 |
perl-ExtUtils-CBuilderRed Hat:enterprise_linux:6::server |
before 1:0.27-119.el6_1.1 | 1:0.27-119.el6_1.1 |
perl-ExtUtils-EmbedRed Hat:enterprise_linux:6::server |
before 0:1.28-119.el6_1.1 | 0:1.28-119.el6_1.1 |
perl-ExtUtils-MakeMakerRed Hat:enterprise_linux:6::server |
before 0:6.55-119.el6_1.1 | 0:6.55-119.el6_1.1 |
perl-ExtUtils-ParseXSRed Hat:enterprise_linux:6::server |
before 1:2.2003.0-119.el6_1.1 | 1:2.2003.0-119.el6_1.1 |
perl-File-FetchRed Hat:enterprise_linux:6::server |
before 0:0.26-119.el6_1.1 | 0:0.26-119.el6_1.1 |
perl-IO-Compress-BaseRed Hat:enterprise_linux:6::server |
before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-IO-Compress-ZlibRed Hat:enterprise_linux:6::server |
before 0:2.020-119.el6_1.1 | 0:2.020-119.el6_1.1 |
perl-IO-ZlibRed Hat:enterprise_linux:6::server |
before 1:1.09-119.el6_1.1 | 1:1.09-119.el6_1.1 |
perl-IPC-CmdRed Hat:enterprise_linux:6::server |
before 1:0.56-119.el6_1.1 | 1:0.56-119.el6_1.1 |
perl-Locale-Maketext-SimpleRed Hat:enterprise_linux:6::server |
before 1:0.18-119.el6_1.1 | 1:0.18-119.el6_1.1 |
perl-Log-MessageRed Hat:enterprise_linux:6::server |
before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Log-Message-SimpleRed Hat:enterprise_linux:6::server |
before 0:0.04-119.el6_1.1 | 0:0.04-119.el6_1.1 |
perl-Module-BuildRed Hat:enterprise_linux:6::server |
before 1:0.3500-119.el6_1.1 | 1:0.3500-119.el6_1.1 |
perl-Module-CoreListRed Hat:enterprise_linux:6::server |
before 0:2.18-119.el6_1.1 | 0:2.18-119.el6_1.1 |
perl-Module-LoadRed Hat:enterprise_linux:6::server |
before 1:0.16-119.el6_1.1 | 1:0.16-119.el6_1.1 |
perl-Module-Load-ConditionalRed Hat:enterprise_linux:6::server |
before 0:0.30-119.el6_1.1 | 0:0.30-119.el6_1.1 |
perl-Module-LoadedRed Hat:enterprise_linux:6::server |
before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Module-PluggableRed Hat:enterprise_linux:6::server |
before 1:3.90-119.el6_1.1 | 1:3.90-119.el6_1.1 |
perl-Object-AccessorRed Hat:enterprise_linux:6::server |
before 1:0.34-119.el6_1.1 | 1:0.34-119.el6_1.1 |
perl-Package-ConstantsRed Hat:enterprise_linux:6::server |
before 1:0.02-119.el6_1.1 | 1:0.02-119.el6_1.1 |
perl-Params-CheckRed Hat:enterprise_linux:6::server |
before 1:0.26-119.el6_1.1 | 1:0.26-119.el6_1.1 |
perl-Parse-CPAN-MetaRed Hat:enterprise_linux:6::server |
before 1:1.40-119.el6_1.1 | 1:1.40-119.el6_1.1 |
perl-Pod-EscapesRed Hat:enterprise_linux:6::server |
before 1:1.04-119.el6_1.1 | 1:1.04-119.el6_1.1 |
perl-Pod-SimpleRed Hat:enterprise_linux:6::server |
before 1:3.13-119.el6_1.1 | 1:3.13-119.el6_1.1 |
perl-Term-UIRed Hat:enterprise_linux:6::server |
before 0:0.20-119.el6_1.1 | 0:0.20-119.el6_1.1 |
perl-Test-HarnessRed Hat:enterprise_linux:6::server |
before 0:3.17-119.el6_1.1 | 0:3.17-119.el6_1.1 |
perl-Test-SimpleRed Hat:enterprise_linux:6::server |
before 0:0.92-119.el6_1.1 | 0:0.92-119.el6_1.1 |
perl-Time-HiResRed Hat:enterprise_linux:6::server |
before 4:1.9721-119.el6_1.1 | 4:1.9721-119.el6_1.1 |
perl-Time-PieceRed Hat:enterprise_linux:6::server |
before 0:1.15-119.el6_1.1 | 0:1.15-119.el6_1.1 |
perl-coreRed Hat:enterprise_linux:6::server |
before 0:5.10.1-119.el6_1.1 | 0:5.10.1-119.el6_1.1 |
perl-debuginfoRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-develRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-libsRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-parentRed Hat:enterprise_linux:6::server |
before 1:0.221-119.el6_1.1 | 1:0.221-119.el6_1.1 |
perl-suidperlRed Hat:enterprise_linux:6::server |
before 4:5.10.1-119.el6_1.1 | 4:5.10.1-119.el6_1.1 |
perl-versionRed Hat:enterprise_linux:6::server |
before 3:0.77-119.el6_1.1 | 3:0.77-119.el6_1.1 |
perlRed Hat:enterprise_linux:4::as |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-debuginfoRed Hat:enterprise_linux:4::as |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-suidperlRed Hat:enterprise_linux:4::as |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perlRed Hat:enterprise_linux:4::desktop |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-debuginfoRed Hat:enterprise_linux:4::desktop |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-suidperlRed Hat:enterprise_linux:4::desktop |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perlRed Hat:enterprise_linux:4::es |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-debuginfoRed Hat:enterprise_linux:4::es |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-suidperlRed Hat:enterprise_linux:4::es |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perlRed Hat:enterprise_linux:4::ws |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-debuginfoRed Hat:enterprise_linux:4::ws |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perl-suidperlRed Hat:enterprise_linux:4::ws |
before 3:5.8.5-57.el4 | 3:5.8.5-57.el4 |
perlRed Hat:enterprise_linux:5::client |
before 4:5.8.8-32.el5_7.6 | 4:5.8.8-32.el5_7.6 |
perl-debuginfoRed Hat:enterprise_linux:5::client |
before 4:5.8.8-32.el5_7.6 | 4:5.8.8-32.el5_7.6 |
perl-suidperlRed Hat:enterprise_linux:5::client |
before 4:5.8.8-32.el5_7.6 | 4:5.8.8-32.el5_7.6 |
perlRed Hat:enterprise_linux:5::server |
before 4:5.8.8-32.el5_7.6 | 4:5.8.8-32.el5_7.6 |
perl-debuginfoRed Hat:enterprise_linux:5::server |
before 4:5.8.8-32.el5_7.6 | 4:5.8.8-32.el5_7.6 |
perl-suidperlRed Hat:enterprise_linux:5::server |
before 4:5.8.8-32.el5_7.6 | 4:5.8.8-32.el5_7.6 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Perl 5.x - Digest Module 'Digest->new()' Code Injection | 2011-10-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-3597 is a high vulnerability (CVSS 7.5) in Gisle Aas Digest, published January 13, 2012. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.1%, the 96th percentile. Fixed in perl 5.12.4-6.
References
redhat.com/support/errata/RHSA-2011-1797.html
bugzilla.redhat.com/show_bug.cgi?id=743010
mandriva.com/security/advisories?name=MDVSA-2012:009
aix.software.ibm.com/aix/efixes/security/perl_advisory2.asc
ubuntu.com/usn/USN-1643-1
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19446
Show 29 moreShow less
kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
secunia.com/advisories/46279
cpansearch.perl.org/src/GAAS/Digest-1.17/Changes
securityfocus.com/bid/49911
nvd.nist.gov/vuln/detail/CVE-2011-3597
github.com/advisories/GHSA-42c5-x389-m7vp
security-tracker.debian.org/tracker/CVE-2011-3597
access.redhat.com/errata/RHSA-2011:1424
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1424.json
cve.org/CVERecord?id=CVE-2011-2939