Check Perl 5.38.1 Security Coverage on Ubuntu

Two CVEs shipped with the Perl 5.38.1 security release, and the only way to know if you need them is to check your actual runtime. This guide identifies whether a Perl install is older than 5.38.1, records the package version that really supplies it, and upgrades an Ubuntu installation when required. Allow about ten minutes for the checks, plus whatever time your package manager needs. Commands below were checked on a host running Perl 5.38.2 and Ubuntu package 5.38.2-3.2ubuntu0.6.

This is an audit and package-maintenance guide, not an attempt to reproduce either vulnerability. Do not paste attacker-controlled regular expressions into a test program, and do not build a fake Windows cmd.exe to test the second issue.

1. Read what perl5381delta actually covers

• CVE-2023-47038. A one-byte heap buffer overflow triggered by a crafted regular expression using an illegal user-defined Unicode property, affecting Perl 5.30.0 through 5.38.0.
• CVE-2023-47039. A Windows path-search issue that could let an attacker supply cmd.exe from the current directory or another weakly controlled location.

A Linux host is not exposed to that Windows path-search behaviour, but its Perl runtime can still be too old for the first fix. The installed manual describes the differences between Perl 5.38.0 and 5.38.1:

$ man perl5381delta
$ perl -e 'print "$^V\n"'
v5.38.2

2. Check the interpreter selected by your shell

Confirm which executable runs when a script invokes perl. This matters on any machine running a distribution Perl, a locally built Perl and a version manager side by side.

$ command -v perl
/usr/bin/perl
$ perl -e 'printf "perl=%s\n", $^V'
perl=v5.38.2
$ perl -e 'die "Perl is older than 5.38.1\n" unless $^V ge v5.38.1; print "Perl is at least 5.38.1\n"'
Perl is at least 5.38.1

That final check is a version comparison performed by Perl itself. It does not inspect a package database, and it says nothing about whether a different interpreter is hard-coded into a service unit or a script's shebang. If it fails, stop before running the application under that interpreter.

3. Match the runtime to its Debian package

On Ubuntu, use dpkg-query to see installed packages and apt-cache policy to compare installed and candidate versions. Both are read-only and need no sudo:

$ dpkg-query -W -f='${Package} ${Version}\n' perl perl-doc
perl 5.38.2-3.2ubuntu0.6
perl-doc 5.38.2-3.2ubuntu0.6
$ apt-cache policy perl perl-doc
perl:
  Installed: 5.38.2-3.2ubuntu0.6
  Candidate: 5.38.2-3.2ubuntu0.6

Package revisions carry distribution suffixes, so compare the upstream runtime with perl -e and record the full Debian version separately. The perl-doc package supplies this manual, useful for reading release notes, but it does not replace the perl interpreter package.

4. Upgrade an affected Ubuntu installation

Only run this during a suitable maintenance window. Package upgrades change files under system directories and can require dependent services or applications to restart later. Before proceeding, save your package and service change procedure, and confirm you can restore the machine from its normal snapshot or backup if the application does not start afterwards.

$ sudo apt-get update
$ sudo apt-get install --only-upgrade perl perl-doc

5. Verify the result and the application boundary

Run the same checks again in the shell that will launch the application. A package transaction can succeed while a service still uses a virtual environment, a bundled Perl, or a fixed interpreter path:

$ command -v perl
/usr/bin/perl
$ perl -e 'printf "perl=%s\n", $^V; die "runtime too old\n" unless $^V ge v5.38.1'
perl=v5.38.2
$ dpkg-query -W -f='${Package} ${Version}\n' perl perl-doc
perl 5.38.2-3.2ubuntu0.6
perl-doc 5.38.2-3.2ubuntu0.6

For a service, inspect its configured executable without restarting it. Replace the placeholder with the real unit name:

$ systemctl cat YOUR-SERVICE.service | grep -E '^(ExecStart|Environment)='
$ systemctl show YOUR-SERVICE.service --property=ExecStart --no-pager

Both inspection commands are read-only. Do not restart a production service solely because this guide says to. Schedule that action, check its rollback path, then use the service's own health check and logs to confirm it came back with the intended interpreter.

6. Keep the scope of the fix clear

Perl 5.38.1 fixes the two issues described in this delta document; it is not a general security audit of your Perl application or its CPAN dependencies. The manual also says to read perl5380delta when upgrading from an earlier development release, and points to Changes, INSTALL and README for other release and build details.

If you need to report a suspected Perl bug, the manual points to the Perl issue tracker. Do not put sensitive vulnerability details into a public issue, use the private security contact process described by perlsec when public reporting would expose a working exploit.