CVE-2017-20230 Details
Description
Storable versions before 3.05 for Perl has a stack overflow. The retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow.
A stack overflow vulnerability has been identified in the Perl Storable module, specifically in versions prior to 3.05. The issue arises in the retrieve_hook function, where the length of the class name is stored as a signed integer. During read operations, this length is treated as unsigned, creating a mismatch that an attacker could exploit. By crafting data that takes advantage of this discrepancy, an attacker could trigger the overflow.
Users should upgrade to Storable version 3.05 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch | CPANSec | Patch |
| https://github.com/Perl/perl5/issues/15831 | CPANSec | Issue Tracking |
| https://metacpan.org/release/RURBAN/Storable-3.05/changes | CPANSec | Release Notes |
| https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html | CPANSec | Third Party Advisory |
| https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html | CPANSec | Third Party Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/21/5 | CVE | Mailing List |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| nwclark storable | < 3.05 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CPANSec |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | CVE Modified | CVE |
| Apr 21, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | CPANSec |