{"id":28861,"date":"2026-09-25T08:31:39","date_gmt":"2026-09-25T00:31:39","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97230"},"modified":"2026-09-25T08:31:39","modified_gmt":"2026-09-25T00:31:39","slug":"cve-2026-97230","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-97230","title":{"rendered":"CVE-2026-97230 &#8211; IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Py"},"content":{"rendered":"<p>IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.<\/p>\n<p>The generate_certificate runs a Python script saved as a certificate file.  The pyhton script attempts to retrieve code from a hardcoded http URL that is obfuscated with base64 encoding and run the response body directly.<\/p>\n<p>The impact is that arbitrary code can be invoked as the user, without a dropped script being saved on the affected host.<\/p>\n<p>The releases have no test scripts nor build hooks.  The intention may have been to trigger the payload after installation.<\/p>\n<p>The dropper script is in lib\/Crypt\/SelfCertificate\/sample\/cert.pem.<\/p>\n<p>This is similar to CVE-2026-95831 for the module Crypt::SelfCertificate.<\/p>\n<p>The SHA-256 digests of the files are<\/p>\n<p>    ba24ee8ec3b7f47f65bed62e16fb413ace50653cf44bd8ea90914390922831e0  IO-Socket-SSL-SelfCertificate-1.00.tar.gz<br \/>\n    821d38830e5eb8607738421c25ac25f59fff02a6ab67daa32fbd020429454dac  IO-Socket-SSL-SelfCertificate-1.00\/lib\/IO\/Socket\/SSL\/SelfCertificate\/sample\/cert.pem<\/p>\n<p>    d483cb7b23b7271cb11cf242bff4a2e1c02df0b9525eb0429abeea8961c399d5  IO-Socket-SSL-SelfCertificate-1.00-upload.tar.gz<\/p>\n","protected":false},"excerpt":{"rendered":"<p>IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL.<\/p>\n<p>The generate_certificate runs a Python script saved as a certificate file. <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28861","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}