{"id":"CVE-2011-2767","aliases":["DEBIAN-CVE-2011-2767","DLA-1507-1","EUVD-2011-2741","GHSA-hm7f-5jxx-cwvg","MGASA-2018-0474","RHSA-2018:2737","RHSA-2018:2825","RHSA-2018:2826","SUSE-SU-2019:3213-1","SUSE-SU-2020:14266-1","UBUNTU-CVE-2011-2767","USN-3825-1","openSUSE-SU-2019:2549-1","openSUSE-SU-2019:2558-1","openSUSE-SU-2024:10626-1"],"status":"published","title":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a...","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.08834,"percentile":0.95227,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-94"],"published":"2018-08-26T00:00:00Z","modified":"2026-10-23T18:03:44Z","fixes":[{"ecosystem":"Debian:12","package":"libapache2-mod-perl2","fixed_in":["2.0.10-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-perl2","fixed_in":["2.0.10-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-perl2","fixed_in":["2.0.10-3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libapache2-mod-perl2","fixed_in":["2.0.9~1624218-2+deb8u3"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"apache-mod_perl","fixed_in":["2.0.10-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_perl","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_perl-debuginfo","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_perl-devel","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_perl","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_perl-debuginfo","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_perl-devel","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_perl","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_perl-debuginfo","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_perl-devel","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_perl","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_perl-debuginfo","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_perl-devel","fixed_in":["0:2.0.4-12.el6_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl526-mod_perl","fixed_in":["0:2.0.10-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl526-mod_perl-debuginfo","fixed_in":["0:2.0.10-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl526-mod_perl-devel","fixed_in":["0:2.0.10-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-perl524-mod_perl","fixed_in":["0:2.0.9-10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-perl524-mod_perl-debuginfo","fixed_in":["0:2.0.9-10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-perl524-mod_perl-devel","fixed_in":["0:2.0.9-10.el6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl524-mod_perl","fixed_in":["0:2.0.9-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl524-mod_perl-debuginfo","fixed_in":["0:2.0.9-10.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl524-mod_perl-devel","fixed_in":["0:2.0.9-10.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"apache2-mod_perl","fixed_in":["2.0.8-13.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"apache2-mod_perl","fixed_in":["2.0.8-13.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"apache2-mod_perl","fixed_in":["2.0.8-13.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2-mod_perl","fixed_in":["2.0.8-13.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_perl","fixed_in":["2.0.8-13.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_perl","fixed_in":["2.0.8-13.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"apache2-mod_perl","fixed_in":["2.0.4-40.63.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"apache2-mod_perl","fixed_in":["2.0.4-40.63.3.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libapache2-mod-perl2","fixed_in":["2.0.8+httpd24-r1449661-6ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-perl2","fixed_in":["2.0.9-4ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-perl2","fixed_in":["2.0.10-2ubuntu3.18.04.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"apache2-mod_perl","fixed_in":["2.0.11-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"apache2-mod_perl","fixed_in":["2.0.11-lp151.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"apache2-mod_perl","fixed_in":["2.0.11-bp151.4.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP1","package":"apache2-mod_perl","fixed_in":["2.0.11-bp151.4.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-3"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9~1624218-2+deb8u3"}]}],"versions":["2.0.9~1624218-2","2.0.9~1624218-2+deb8u1","2.0.9~1624218-2+deb8u2"]},{"source":"osv","ecosystem":"Mageia:6","package":"apache-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.4-12.el6_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl526-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl526-mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl526-mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.10-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-perl524-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-perl524-mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el6","package":"rh-perl524-mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-10.el6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl524-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl524-mod_perl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-10.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:3::el7","package":"rh-perl524-mod_perl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.0.9-10.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-13.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-13.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-13.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-13.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-13.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8-13.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-40.63.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.4-40.63.3.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8+httpd24-r1449661-6ubuntu2.1"}]}],"versions":["2.0.8+httpd24-r1449661-6ubuntu1","2.0.8+httpd24-r1449661-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-4ubuntu1.2"}]}],"versions":["2.0.9-1ubuntu1","2.0.9-4ubuntu1","2.0.9-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-2ubuntu3.18.04.1"}]}],"versions":["2.0.10-2ubuntu2","2.0.10-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8+httpd24-r1449661-6ubuntu2.1"}]}],"versions":["2.0.8+httpd24-r1449661-6ubuntu1","2.0.8+httpd24-r1449661-6ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.9-4ubuntu1.2"}]}],"versions":["2.0.9-1ubuntu1","2.0.9-4ubuntu1","2.0.9-4ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-perl2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10-2ubuntu3.18.04.1"}]}],"versions":["2.0.10-2ubuntu2","2.0.10-2ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-lp151.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP1","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-bp151.4.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.11-2.12"}]}],"bundled":2}],"products":[{"vendor":"apache","product":"mod_perl"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securityfocus.com/bid/105195","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://usn.ubuntu.com/3825-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugs.debian.org/644169","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2826","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/raw/%3C20111004084343.GA21290%40ktnx.net%3E","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2825","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2737","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/3825-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d%40%3Cmodperl-cvs.perl.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00063.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00065.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-2767","tags":["advisory"]},{"url":"https://lists.apache.org/thread.html/c8ebe8aad147a3ad2e7b0e8b2da45263171ab5d0fc7f8c100feaa94d@%3Cmodperl-cvs.perl.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-hm7f-5jxx-cwvg"},{"url":"https://security-tracker.debian.org/tracker/CVE-2011-2767","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0474.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23541","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/G3GS7G4X3FRAUBMBVQ4QXZAGZH2JIMG4/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623265","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2737.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2011-2767","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-2767","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2825.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2826.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20193213-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1091625","tags":["report"]},{"url":"https://bugzilla.suse.com/1156944","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2767","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014266-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2011-2767","tags":["report"]},{"url":"https://mail-archives.apache.org/mod_mbox/perl-modperl/201110.mbox/%3C20111004084343.GA21290%40ktnx.net%3E","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3825-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3825-2","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OOUAW3DINWADZIN3D7TK5OLPCE7OIX65/#OOUAW3DINWADZIN3D7TK5OLPCE7OIX65","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PWEC4EIUBAIJQYPFPIN7W2ATHFW5U5ZQ/#PWEC4EIUBAIJQYPFPIN7W2ATHFW5U5ZQ","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1349","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2011-2767","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2018-08-26T16:00:00Z","modified":"2024-08-06T23:15:30.814Z","updated_at":"2026-11-02T14:35:36.968002Z"}],"euvd":[{"id":"EUVD-2011-2741","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2018-08-26T16:00:00Z","modified":"2024-08-06T23:15:30Z","updated_at":"2026-11-03T01:39:54.68331Z"}],"ghsa":[{"id":"GHSA-hm7f-5jxx-cwvg","title":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a...","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2022-05-13T01:54:08Z","modified":"2023-02-02T05:02:27Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:51:26.673587Z"}],"nvd":[{"id":"CVE-2011-2767","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2018-08-26T16:29:00.23Z","modified":"2026-06-16T23:31:57.78Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:02:12.945371Z"}],"osv":[{"id":"CVE-2011-2767","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2018-08-26T16:29:00Z","modified":"2026-04-16T06:20:36.040235842Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:43:58.279353Z"},{"id":"DEBIAN-CVE-2011-2767","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2018-08-26T16:29:00.23Z","modified":"2026-10-23T18:03:44.585622043Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:24.612044Z"},{"id":"RHSA-2018:2737","title":"Red Hat Security Advisory: mod_perl security update","status":"published","published":"2024-09-13T07:09:09Z","modified":"2026-06-29T10:22:08Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2825","title":"Red Hat Security Advisory: rh-perl526-mod_perl security update","status":"published","published":"2024-09-13T07:09:15Z","modified":"2026-06-29T10:22:15Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"RHSA-2018:2826","title":"Red Hat Security Advisory: rh-perl524-mod_perl security update","status":"published","published":"2024-09-13T07:09:21Z","modified":"2026-06-29T10:22:16Z","cvss":[{"version":"3.0","score":6.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2011-2767","description":"mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.","status":"published","published":"2018-08-26T00:00:00Z","modified":"2026-04-22T09:04:14.758851Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:06.395274Z"},{"id":"DLA-1507-1","title":"libapache2-mod-perl2 - security update","status":"published","published":"2018-09-18T00:00:00Z","modified":"2026-03-09T01:01:30.791525Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2018-0474","title":"Updated apache-mod_perl packages fix security vulnerability","description":"A flaw was found in mod_perl 2.0 through 2.0.10 which allows attackers\nto execute arbitrary Perl code by placing it in a user-owned .htaccess\nfile, because (contrary to the documentation) there is no configuration\noption that permits Perl code for the administrator's control of HTTP\nrequest processing without also permitting unprivileged users to run\nPerl code in the context of the user account that runs Apache HTTP\nServer processes (CVE-2011-2767).\n","status":"published","published":"2018-12-02T22:15:20Z","modified":"2026-04-16T06:22:40.653953855Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2019:2549-1","title":"Security update for apache2-mod_perl","description":"This update for apache2-mod_perl to version 2.0.11 fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2011-2767: Fixed a vulnerability which could have allowed \n  perl code execution in the context of user account (bsc#1156944).\n\nOther issue addressed:\n\n- Restore process name after sv_setpv_mg() call. (bsc#1091625)\t  \n","status":"published","published":"2019-11-23T17:20:34Z","modified":"2026-02-04T02:24:07.714924Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2019:2558-1","title":"Security update for apache2-mod_perl","description":"This update for apache2-mod_perl to version 2.0.11 fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2011-2767: Fixed a vulnerability which could have allowed \n  perl code execution in the context of user account (bsc#1156944).\n\nOther issue addressed:\n\n- Restore process name after sv_setpv_mg() call. (bsc#1091625)\t  \n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-11-24T05:14:23Z","modified":"2026-02-04T02:49:05.158742Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10626-1","title":"apache2-mod_perl-2.0.11-2.12 on GA media","description":"These are all security issues fixed in the apache2-mod_perl-2.0.11-2.12 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:20:34.877481Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:3213-1","title":"Security update for apache2-mod_perl","description":"This update for apache2-mod_perl fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2011-2767: Fixed a vulnerability which could have allowed \n  perl code execution in the context of user account (bsc#1156944).\n\nOther issue addressed:\n\n- Restore process name after sv_setpv_mg() call. (bsc#1091625)\n","status":"published","published":"2019-12-10T09:05:53Z","modified":"2026-02-04T04:04:20.277427Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:14266-1","title":"Security update for apache2-mod_perl","description":"This update for apache2-mod_perl fixes the following issues:\n\n- CVE-2011-2767: Fixed a vulnerability which could have allowed \n  perl code execution in the context of user account (bsc#1156944).\n","status":"published","published":"2020-01-09T10:18:03Z","modified":"2026-02-04T04:15:13.351337Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-3825-1","title":"libapache2-mod-perl2 vulnerability","description":"Jan Ingvoldstad discovered that mod_perl incorrectly handled configuration\noptions to disable being used by unprivileged users, contrary to the\ndocumentation. A local attacker could possibly use this issue to execute\narbitrary Perl code.\n","status":"published","published":"2018-11-21T16:10:07Z","modified":"2026-04-22T09:52:34.712089Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}