The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3985 advisory.

    A critical arbitrary code execution vulnerability (CWE-94) found in the DBD::DBM database driver, which is     a core component shipped within the Perl DBI (Database Interface) module. The flaw exists because the     dbm_type and dbm_mldbm handle attributes pass user-influenced input directly into Perl's native require()     function without verifying if the arguments are valid module names.Perl's require() function handles     strings containing file paths differently than standard module names. If it receives a path-shaped string     (e.g., pointing outside standard libraries), it treats it as a literal filename and bypasses the safe @INC     directory restrictions. As a result, an attacker who can influence either of these configuration     attributes can force the application to load and automatically execute an untrusted .pm (Perl module) file     from any location on the filesystem. (CVE-2026-78030)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793617036 advisory.

  - DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm     attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without     checking that the value names a module. require treats a path-shaped string as a literal filename and does     not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer::
    prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /,     so a value containing / traverses out of the serializer directory. The value is also assigned to     $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an     untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects     a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn =     dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer     forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a     driver prefix. (CVE-2026-78030)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 675bc714-b8cd-11f1-ad2b-40b034429ecf advisory.

    DBI project reports:
    DBI 1.650, 1.651, 1.652, 1.653 and 1.654 fix the following issues:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:23919-1 advisory.

    This update for perl-DBI fixes the following issue:

    - CVE-2026-78030: arbitrary modules loaded due to unvalidated `dbm_type` and `dbm_mldbm` attributes in     `DBD::DBM`       (bsc#1281704).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:99120 advisory.

    The perl-DBI package provides the standard database interface module for the Perl programming language. It     implements a database-independent interface, meaning it defines a consistent set of methods, variables,     and conventions for database operations.

    Security Fix(es):

    * perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in     DBD::DBM (CVE-2026-78030)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:99210 advisory.

    The perl-DBI package provides the standard database interface module for the Perl programming language. It     implements a database-independent interface, meaning it defines a consistent set of methods, variables,     and conventions for database operations.

    Security Fix(es):

    * perl-DBI: DBI: Loading of arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in     DBD::DBM (CVE-2026-78030)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm     attributes in DBD::DBM. DBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without     checking that the value names a module. require treats a path-shaped string as a literal filename and does     not consult @INC, so the attribute chooses the file that Perl loads and runs. The MLDBM::Serializer::
    prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /,     so a value containing / traverses out of the serializer directory. The value is also assigned to     $MLDBM::Serializer, which MLDBM requires the same way when it ties the table. A caller that lets an     untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects     a storage backend, runs the file-scope code of whatever module the value names. For example, my $dsn =     dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm my $dbh = DBI->connect( $dsn ); Note that DBD::Gofer     forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a     driver prefix. (CVE-2026-78030)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
365284	Amazon Linux 2 : perl-DBI (ALAS-2026-3985)	Nessus	Amazon Linux Local Security Checks	2026/10/12	2026/10/23	critical
375161	AlmaLinux 9.6 [TuxCare] Security Update: perl-DBI (ALMALINUX9.6:CLSA-2026:1793617036)	Nessus	Alma Linux Local Security Checks	2026/11/2	2026/11/2	critical
350688	FreeBSD : databases/p5-DBI -- multiple vulnerabilities (675bc714-b8cd-11f1-ad2b-40b034429ecf)	Nessus	FreeBSD Local Security Checks	2026/9/25	2026/10/23	critical
351410	SUSE SLES16 Security Update : perl-DBI (SUSE-SU-2026:23919-1)	Nessus	SuSE Local Security Checks	2026/9/30	2026/10/23	critical
379365	RHEL 10 : perl-DBI (RHSA-2026:99120)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/11	critical
379351	RHEL 8 : perl-DBI:1.641 (RHSA-2026:99210)	Nessus	Red Hat Local Security Checks	2026/11/11	2026/11/11	critical
345014	Linux Distros Unpatched Vulnerability : CVE-2026-78030	Nessus	Misc.	2026/9/12	2026/11/12	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical