CVE-2017-20230
Stack Overflow in Perl Storable < 3.05 Enables Exploits
Publication date: 2026-04-21
Last updated on: 2026-04-22
Assigner: CPANSec
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nwclark | storable | to 3.05 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-121 | A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2017-20230 is a stack overflow vulnerability in the Perl Storable module versions before 3.05. It occurs in the retrieve_hook function, which improperly handles the length of class names during deserialization. Specifically, the length is stored as a signed integer but treated as unsigned during read operations, allowing attackers to craft malicious data that triggers a stack overflow.
The vulnerability arises because the module does not validate the class name length properly, which can lead to integer overflows, buffer overflows, or excessive memory allocation attempts. This can cause crashes or stack corruption when processing specially crafted Storable files.
A patch was developed to fix this by enforcing strict length validation, safe memory allocation, and robust error handling to prevent stack overflows and crashes.
How can this vulnerability impact me? :
This vulnerability can lead to a stack overflow or memory corruption when processing maliciously crafted Storable data files in Perl applications. The immediate impact includes program crashes or unexpected termination due to buffer overflows or failed memory allocations.
If exploited, it could potentially allow an attacker to execute arbitrary code or cause denial of service by crashing the application that uses the vulnerable Storable module.
However, the Perl 5 Porters team noted that local Storable files are not exploitable remotely, which may limit the attack surface depending on how the application uses Storable.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to the Perl Storable module's handling of serialized data, specifically in the retrieve_hook function. Detection involves identifying if your system uses a vulnerable version of the Storable module (versions before 3.05).
Since the vulnerability is triggered by maliciously crafted Storable files with corrupted class name lengths, detection on a network level is difficult without inspecting the contents of Storable files being deserialized.
To detect if your system is vulnerable, you can check the installed version of the Perl Storable module by running the following command in a terminal:
- perl -MStorable -e 'print $Storable::VERSION, "\n"'
If the version is earlier than 3.05, your system is vulnerable.
Additionally, you can audit your applications or scripts that deserialize Storable data to check if they handle untrusted input, as maliciously crafted Storable files can trigger the overflow.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to upgrade the Perl Storable module to version 3.05 or later, where the vulnerability has been patched.
The patch enforces strict validation of class name lengths during deserialization, preventing stack overflow and memory corruption.
If upgrading immediately is not possible, avoid deserializing untrusted or unauthenticated Storable data, as the vulnerability is triggered by maliciously crafted input.
Review and restrict access to any services or scripts that accept Storable serialized data to minimize exposure.
Monitor for updates and apply the official patch from the Perl repository or your package maintainer as soon as possible.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided context and resources do not contain information regarding the impact of CVE-2017-20230 on compliance with common standards and regulations such as GDPR or HIPAA.