https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 00:54:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-97230 <p>IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.</p> <p>The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.</p> <p>The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.</p> <p>The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.</p> <p>The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.</p> <p>This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.</p> <p>The SHA-256 digests of the files are</p> <p>ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem</p> <p>d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz</p> <p>IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.</p> <p>The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.</p> <p>The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.</p> <p>The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.</p> <p>The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.</p> <p>This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.</p> <p>The SHA-256 digests of the files are</p> <p>ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem</p> <p>d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-97230 https://vulnerability.circl.lu/vuln/ghsa-559w-6g2v-jh67 <p>IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.</p> <p>The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.</p> <p>The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.</p> <p>The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.</p> <p>The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.</p> <p>This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.</p> <p>The SHA-256 digests of the files are</p> <p>ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem</p> <p>d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz</p> <p>IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.</p> <p>The generate_certificate runs a Python script saved as a certificate file. The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.</p> <p>The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.</p> <p>The releases have no test scripts nor build hooks. The intention may have been to trigger the payload after installation.</p> <p>The dropper script is in lib/Crypt/SelfCertificate/sample/cert.pem.</p> <p>This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.</p> <p>The SHA-256 digests of the files are</p> <p>ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0 IO-Socket-SSL-SelfCertificate-1.00.tar.gz 821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac IO-Socket-SSL-SelfCertificate-1.00/lib/IO/Socket/SSL/SelfCertificate/sample/cert.pem</p> <p>d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5 IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz</p> https://vulnerability.circl.lu/vuln/ghsa-559w-6g2v-jh67