CVE-2014-10402: 
CBL Mariner vulnerability analysis and mitigation

An issue was discovered in the DBI (Database Interface) module through version 1.643 for Perl. The vulnerability, identified as CVE-2014-10402, was disclosed on September 16, 2020. This security flaw allows DBD::File drivers to access files from directories other than those specifically designated via the f_dir attribute in the data source name (DSN). Notably, this vulnerability emerged as a result of an incomplete fix for a previous issue, CVE-2014-10401 (MITRE, NVD).

The vulnerability has a CVSS 3.1 Base Score of 6.1 (Medium), with the following characteristics: Local attack vector, Low attack complexity, Low privileges required, No user interaction needed, Unchanged scope, High confidentiality impact, No integrity impact, and Low availability impact. The technical vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L (Ubuntu).

The primary impact of this vulnerability is the potential for information disclosure. An attacker could exploit this flaw to access files from directories outside the intended scope, potentially exposing sensitive information. The vulnerability affects the confidentiality of the system while having no impact on integrity and low impact on availability (Debian LTS).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No specific instances of exploitation in the wild have been publicly reported (Ubuntu).

Multiple vendors have released patches to address this vulnerability. Ubuntu has fixed the issue in various versions: focal (1.643-1ubuntu0.1), bionic (1.640-1ubuntu0.3), and xenial (1.634-1ubuntu0.2+esm1). Debian has also addressed the vulnerability with version 1.636-1+deb9u2 for Debian 9 stretch. Users are recommended to upgrade their libdbi-perl packages to the patched versions (Ubuntu, Debian LTS).