CVE-2023-31484

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CISA-ADPADP
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
VendorProductVersion
cpanpm_projectcpanpm
𝑥
< 2.35
perlperl
𝑥
< 5.38.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
perl
bullseye
vulnerable
bookworm
no-dsa
buster
no-dsa
bullseye (security)
5.32.1-4+deb11u4
fixed
trixie
5.40.0-8
fixed
sid
5.40.0-8
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
perl
lunar
Fixed 5.36.0-7ubuntu0.23.04.1
released
kinetic
Fixed 5.34.0-5ubuntu1.2
released
jammy
Fixed 5.34.0-3ubuntu1.2
released
focal
Fixed 5.30.0-9ubuntu0.4
released
bionic
Fixed 5.26.1-6ubuntu0.7
released
xenial
Fixed 5.22.1-9ubuntu0.9+esm2
released
trusty
Fixed 5.18.2-2ubuntu1.7+esm5
released
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2023/04/29/1
http://www.openwall.com/lists/oss-security/2023/05/03/3
http://www.openwall.com/lists/oss-security/2023/05/03/5
http://www.openwall.com/lists/oss-security/2023/05/07/2
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
https://github.com/andk/cpanpm/pull/175
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
https://metacpan.org/dist/CPAN/changes
https://security.netapp.com/advisory/ntap-20240621-0007/
https://www.openwall.com/lists/oss-security/2023/04/18/14
http://www.openwall.com/lists/oss-security/2023/04/29/1
http://www.openwall.com/lists/oss-security/2023/05/03/3
http://www.openwall.com/lists/oss-security/2023/05/03/5
http://www.openwall.com/lists/oss-security/2023/05/07/2
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
https://github.com/andk/cpanpm/pull/175
https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
https://metacpan.org/dist/CPAN/changes
https://security.netapp.com/advisory/ntap-20240621-0007/
https://www.openwall.com/lists/oss-security/2023/04/18/14