CVE-2021-36770

A flaw was found in perl-Encode, where the Perl5 Encode module loaded modules within the current directory. This flaw allows an attacker with write access to the current directory of a Perl5 process to inject arbitrary Perl code when this module is loaded, which can be used for a local privilege escalation. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Red Hat Enterprise Linux 7 and 8 (including Software Collection) provide older versions of Perl and the Encode library, which are not affected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.