========================================================================
CVE-2011-10043                                       CPAN Security Group
========================================================================

         CVE ID:  CVE-2011-10043
   Distribution:  Module-Load
       Versions:  before 0.22

       MetaCPAN:  https://metacpan.org/dist/Module-Load
       VCS Repo:  https://github.com/jib/module-load

Module::Load versions before 0.22 for Perl allow arbitrary modules
outside of @INC to be loaded

Description
-----------
Module::Load versions before 0.22 for Perl allow arbitrary modules
outside of @INC to be loaded.

Module names starting with "::" could be passed to the load function to
specify arbitrary module paths.

Attackers able to influence module names passed to load could use that
bug to execute arbitrary code.

Problem types
-------------
- CWE-145 Improper Neutralization of Section Delimiters

Solutions
---------
If you are using Perl v5.15.3 or earlier, then upgrade to Module::Load
0.22 or later.

Perl versions after v5.15.4 include newer versions of Module::Load that
fix this issue.

References
----------
https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html
https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm
https://metacpan.org/release/BINGOS/Module-Load-0.22/changes

Timeline
--------
- 2011-10-02: General issue identified by Michael G Schwern in blog
   post.
- 2011-10-04: Module::Load 0.22 released.
- 2011-10-20: Perl v5.15.4 released with Module::Load 0.22.