OESA-2025-1631

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1631

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2025-1631.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2025-1631

Upstream

CVE-2025-40909

Published

2025-06-13T14:20:20Z

Modified

2025-08-12T05:50:42.426461Z

Summary

perl security update

Details

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

Perl threads have a working directory race condition where file operations may target unintended paths.

If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running.

This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.

The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6(CVE-2025-40909)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:20.03-LTS-SP4 / perl

Package

Name: perl
Purl: pkg:rpm/openEuler/perl&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.28.3-11.oe2003sp4

Ecosystem specific

{
    "aarch64": [
        "perl-5.28.3-11.oe2003sp4.aarch64.rpm",
        "perl-debuginfo-5.28.3-11.oe2003sp4.aarch64.rpm",
        "perl-debugsource-5.28.3-11.oe2003sp4.aarch64.rpm",
        "perl-devel-5.28.3-11.oe2003sp4.aarch64.rpm",
        "perl-libs-5.28.3-11.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "perl-5.28.3-11.oe2003sp4.x86_64.rpm",
        "perl-debuginfo-5.28.3-11.oe2003sp4.x86_64.rpm",
        "perl-debugsource-5.28.3-11.oe2003sp4.x86_64.rpm",
        "perl-devel-5.28.3-11.oe2003sp4.x86_64.rpm",
        "perl-libs-5.28.3-11.oe2003sp4.x86_64.rpm"
    ],
    "noarch": [
        "perl-help-5.28.3-11.oe2003sp4.noarch.rpm"
    ],
    "src": [
        "perl-5.28.3-11.oe2003sp4.src.rpm"
    ]
}

openEuler:22.03-LTS-SP3 / perl

Package

Name: perl
Purl: pkg:rpm/openEuler/perl&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.34.0-16.oe2203sp3

Ecosystem specific

{
    "aarch64": [
        "perl-5.34.0-16.oe2203sp3.aarch64.rpm",
        "perl-debuginfo-5.34.0-16.oe2203sp3.aarch64.rpm",
        "perl-debugsource-5.34.0-16.oe2203sp3.aarch64.rpm",
        "perl-devel-5.34.0-16.oe2203sp3.aarch64.rpm",
        "perl-libs-5.34.0-16.oe2203sp3.aarch64.rpm"
    ],
    "x86_64": [
        "perl-5.34.0-16.oe2203sp3.x86_64.rpm",
        "perl-debuginfo-5.34.0-16.oe2203sp3.x86_64.rpm",
        "perl-debugsource-5.34.0-16.oe2203sp3.x86_64.rpm",
        "perl-devel-5.34.0-16.oe2203sp3.x86_64.rpm",
        "perl-libs-5.34.0-16.oe2203sp3.x86_64.rpm"
    ],
    "noarch": [
        "perl-help-5.34.0-16.oe2203sp3.noarch.rpm"
    ],
    "src": [
        "perl-5.34.0-16.oe2203sp3.src.rpm"
    ]
}

openEuler:22.03-LTS-SP4 / perl

Package

Name: perl
Purl: pkg:rpm/openEuler/perl&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.34.0-14.oe2203sp4

Ecosystem specific

{
    "aarch64": [
        "perl-5.34.0-14.oe2203sp4.aarch64.rpm",
        "perl-debuginfo-5.34.0-14.oe2203sp4.aarch64.rpm",
        "perl-debugsource-5.34.0-14.oe2203sp4.aarch64.rpm",
        "perl-devel-5.34.0-14.oe2203sp4.aarch64.rpm",
        "perl-libs-5.34.0-14.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "perl-5.34.0-14.oe2203sp4.x86_64.rpm",
        "perl-debuginfo-5.34.0-14.oe2203sp4.x86_64.rpm",
        "perl-debugsource-5.34.0-14.oe2203sp4.x86_64.rpm",
        "perl-devel-5.34.0-14.oe2203sp4.x86_64.rpm",
        "perl-libs-5.34.0-14.oe2203sp4.x86_64.rpm"
    ],
    "noarch": [
        "perl-help-5.34.0-14.oe2203sp4.noarch.rpm"
    ],
    "src": [
        "perl-5.34.0-14.oe2203sp4.src.rpm"
    ]
}

openEuler:24.03-LTS / perl

Package

Name: perl
Purl: pkg:rpm/openEuler/perl&distro=openEuler-24.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.38.0-10.oe2403sp1

Ecosystem specific

{
    "aarch64": [
        "perl-5.38.0-10.oe2403.aarch64.rpm",
        "perl-debuginfo-5.38.0-10.oe2403.aarch64.rpm",
        "perl-debugsource-5.38.0-10.oe2403.aarch64.rpm",
        "perl-devel-5.38.0-10.oe2403.aarch64.rpm",
        "perl-libs-5.38.0-10.oe2403.aarch64.rpm",
        "perl-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-debuginfo-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-debugsource-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-devel-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-libs-5.38.0-10.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "perl-5.38.0-10.oe2403.x86_64.rpm",
        "perl-debuginfo-5.38.0-10.oe2403.x86_64.rpm",
        "perl-debugsource-5.38.0-10.oe2403.x86_64.rpm",
        "perl-devel-5.38.0-10.oe2403.x86_64.rpm",
        "perl-libs-5.38.0-10.oe2403.x86_64.rpm",
        "perl-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-debuginfo-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-debugsource-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-devel-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-libs-5.38.0-10.oe2403sp1.x86_64.rpm"
    ],
    "noarch": [
        "perl-help-5.38.0-10.oe2403.noarch.rpm",
        "perl-help-5.38.0-10.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "perl-5.38.0-10.oe2403.src.rpm",
        "perl-5.38.0-10.oe2403sp1.src.rpm"
    ]
}

openEuler:24.03-LTS-SP1 / perl

Package

Name: perl
Purl: pkg:rpm/openEuler/perl&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.38.0-10.oe2403sp1

Ecosystem specific

{
    "aarch64": [
        "perl-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-debuginfo-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-debugsource-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-devel-5.38.0-10.oe2403sp1.aarch64.rpm",
        "perl-libs-5.38.0-10.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "perl-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-debuginfo-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-debugsource-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-devel-5.38.0-10.oe2403sp1.x86_64.rpm",
        "perl-libs-5.38.0-10.oe2403sp1.x86_64.rpm"
    ],
    "noarch": [
        "perl-help-5.38.0-10.oe2403sp1.noarch.rpm"
    ],
    "src": [
        "perl-5.38.0-10.oe2403sp1.src.rpm"
    ]
}