CVE-2023-31486

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
Affected Products (NVD)
VendorProductVersion
http\\
𝑥
< 0.083
perlperl
𝑥
< 5.38.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
libhttp-tiny-perl
bookworm
unimportant
sid
0.090-1
fixed
trixie
0.090-1
fixed
perl
bookworm
unimportant
bullseye
unimportant
bullseye (security)
unimportant
sid
5.40.0-8
fixed
trixie
5.40.0-8
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libhttp-tiny-perl
bionic
ignored
focal
ignored
jammy
ignored
kinetic
ignored
lunar
ignored
trusty
ignored
xenial
ignored
perl
bionic
ignored
focal
ignored
jammy
ignored
kinetic
ignored
lunar
ignored
trusty
ignored
xenial
ignored
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
perl-HTTP-Tiny
RHEL 9
0:0.076-461.el9
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
perl
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-Attribute-Handlers
Amazon Linux 2023
0:1.01-477.amzn2023.0.5
fixed
perl-AutoLoader
Amazon Linux 2023
0:5.74-477.amzn2023.0.5
fixed
perl-AutoSplit
Amazon Linux 2023
0:5.74-477.amzn2023.0.5
fixed
perl-B
Amazon Linux 2023
0:1.80-477.amzn2023.0.5
fixed
perl-B-debuginfo
Amazon Linux 2023
0:1.80-477.amzn2023.0.5
fixed
perl-Benchmark
Amazon Linux 2023
0:1.23-477.amzn2023.0.5
fixed
perl-Class-Struct
Amazon Linux 2023
0:0.66-477.amzn2023.0.5
fixed
perl-Config-Extensions
Amazon Linux 2023
0:0.03-477.amzn2023.0.5
fixed
perl-DBM_Filter
Amazon Linux 2023
0:0.06-477.amzn2023.0.5
fixed
perl-Devel-Peek
Amazon Linux 2023
0:1.28-477.amzn2023.0.5
fixed
perl-Devel-Peek-debuginfo
Amazon Linux 2023
0:1.28-477.amzn2023.0.5
fixed
perl-Devel-SelfStubber
Amazon Linux 2023
0:1.06-477.amzn2023.0.5
fixed
perl-DirHandle
Amazon Linux 2023
0:1.05-477.amzn2023.0.5
fixed
perl-Dumpvalue
Amazon Linux 2023
0:2.27-477.amzn2023.0.5
fixed
perl-DynaLoader
Amazon Linux 2023
0:1.47-477.amzn2023.0.5
fixed
perl-English
Amazon Linux 2023
0:1.11-477.amzn2023.0.5
fixed
perl-Errno
Amazon Linux 2023
0:1.30-477.amzn2023.0.5
fixed
perl-ExtUtils-Constant
Amazon Linux 2023
0:0.25-477.amzn2023.0.5
fixed
perl-ExtUtils-Embed
Amazon Linux 2023
0:1.35-477.amzn2023.0.5
fixed
perl-ExtUtils-Miniperl
Amazon Linux 2023
0:1.09-477.amzn2023.0.5
fixed
perl-Fcntl
Amazon Linux 2023
0:1.13-477.amzn2023.0.5
fixed
perl-Fcntl-debuginfo
Amazon Linux 2023
0:1.13-477.amzn2023.0.5
fixed
perl-File-Basename
Amazon Linux 2023
0:2.85-477.amzn2023.0.5
fixed
perl-File-Compare
Amazon Linux 2023
0:1.100.600-477.amzn2023.0.5
fixed
perl-File-Copy
Amazon Linux 2023
0:2.34-477.amzn2023.0.5
fixed
perl-File-DosGlob
Amazon Linux 2023
0:1.12-477.amzn2023.0.5
fixed
perl-File-DosGlob-debuginfo
Amazon Linux 2023
0:1.12-477.amzn2023.0.5
fixed
perl-File-Find
Amazon Linux 2023
0:1.37-477.amzn2023.0.5
fixed
perl-File-stat
Amazon Linux 2023
0:1.09-477.amzn2023.0.5
fixed
perl-FileCache
Amazon Linux 2023
0:1.10-477.amzn2023.0.5
fixed
perl-FileHandle
Amazon Linux 2023
0:2.03-477.amzn2023.0.5
fixed
perl-FindBin
Amazon Linux 2023
0:1.51-477.amzn2023.0.5
fixed
perl-GDBM_File
Amazon Linux 2023
0:1.18-477.amzn2023.0.5
fixed
perl-GDBM_File-debuginfo
Amazon Linux 2023
0:1.18-477.amzn2023.0.5
fixed
perl-Getopt-Std
Amazon Linux 2023
0:1.12-477.amzn2023.0.5
fixed
perl-HTTP-Tiny
Amazon Linux 1
0:0.033-3.7.amzn1
fixed
Amazon Linux 2
0:0.033-3.amzn2.0.1
fixed
Amazon Linux 2023
0:0.078-1.amzn2023.0.3
fixed
perl-HTTP-Tiny-tests
Amazon Linux 2023
0:0.078-1.amzn2023.0.3
fixed
perl-Hash-Util
Amazon Linux 2023
0:0.23-477.amzn2023.0.5
fixed
perl-Hash-Util-FieldHash
Amazon Linux 2023
0:1.20-477.amzn2023.0.5
fixed
perl-Hash-Util-FieldHash-debuginfo
Amazon Linux 2023
0:1.20-477.amzn2023.0.5
fixed
perl-Hash-Util-debuginfo
Amazon Linux 2023
0:0.23-477.amzn2023.0.5
fixed
perl-I18N-Collate
Amazon Linux 2023
0:1.02-477.amzn2023.0.5
fixed
perl-I18N-LangTags
Amazon Linux 2023
0:0.44-477.amzn2023.0.5
fixed
perl-I18N-Langinfo
Amazon Linux 2023
0:0.19-477.amzn2023.0.5
fixed
perl-I18N-Langinfo-debuginfo
Amazon Linux 2023
0:0.19-477.amzn2023.0.5
fixed
perl-IO
Amazon Linux 2023
0:1.43-477.amzn2023.0.5
fixed
perl-IO-debuginfo
Amazon Linux 2023
0:1.43-477.amzn2023.0.5
fixed
perl-IPC-Open3
Amazon Linux 2023
0:1.21-477.amzn2023.0.5
fixed
perl-Locale-Maketext-Simple
Amazon Linux 2023
1:0.21-477.amzn2023.0.5
fixed
perl-Math-Complex
Amazon Linux 2023
0:1.59-477.amzn2023.0.5
fixed
perl-Memoize
Amazon Linux 2023
0:1.03-477.amzn2023.0.5
fixed
perl-Module-Loaded
Amazon Linux 2023
1:0.08-477.amzn2023.0.5
fixed
perl-NDBM_File
Amazon Linux 2023
0:1.15-477.amzn2023.0.5
fixed
perl-NDBM_File-debuginfo
Amazon Linux 2023
0:1.15-477.amzn2023.0.5
fixed
perl-NEXT
Amazon Linux 2023
0:0.67-477.amzn2023.0.5
fixed
perl-Net
Amazon Linux 2023
0:1.02-477.amzn2023.0.5
fixed
perl-ODBM_File
Amazon Linux 2023
0:1.16-477.amzn2023.0.5
fixed
perl-ODBM_File-debuginfo
Amazon Linux 2023
0:1.16-477.amzn2023.0.5
fixed
perl-Opcode
Amazon Linux 2023
0:1.48-477.amzn2023.0.5
fixed
perl-Opcode-debuginfo
Amazon Linux 2023
0:1.48-477.amzn2023.0.5
fixed
perl-POSIX
Amazon Linux 2023
0:1.94-477.amzn2023.0.5
fixed
perl-POSIX-debuginfo
Amazon Linux 2023
0:1.94-477.amzn2023.0.5
fixed
perl-Pod-Functions
Amazon Linux 2023
0:1.13-477.amzn2023.0.5
fixed
perl-Pod-Html
Amazon Linux 2023
0:1.25-477.amzn2023.0.5
fixed
perl-Pod-Perldoc
Amazon Linux 2
0:3.20-4.amzn2.0.1
fixed
Amazon Linux 2023
0:3.28.01-459.amzn2023.0.3
fixed
perl-Safe
Amazon Linux 2023
0:2.41-477.amzn2023.0.5
fixed
perl-Search-Dict
Amazon Linux 2023
0:1.07-477.amzn2023.0.5
fixed
perl-SelectSaver
Amazon Linux 2023
0:1.02-477.amzn2023.0.5
fixed
perl-SelfLoader
Amazon Linux 2023
0:1.26-477.amzn2023.0.5
fixed
perl-Symbol
Amazon Linux 2023
0:1.08-477.amzn2023.0.5
fixed
perl-Sys-Hostname
Amazon Linux 2023
0:1.23-477.amzn2023.0.5
fixed
perl-Sys-Hostname-debuginfo
Amazon Linux 2023
0:1.23-477.amzn2023.0.5
fixed
perl-Term-Complete
Amazon Linux 2023
0:1.403-477.amzn2023.0.5
fixed
perl-Term-ReadLine
Amazon Linux 2023
0:1.17-477.amzn2023.0.5
fixed
perl-Test
Amazon Linux 2023
0:1.31-477.amzn2023.0.5
fixed
perl-Text-Abbrev
Amazon Linux 2023
0:1.02-477.amzn2023.0.5
fixed
perl-Thread
Amazon Linux 2023
0:3.05-477.amzn2023.0.5
fixed
perl-Thread-Semaphore
Amazon Linux 2023
0:2.13-477.amzn2023.0.5
fixed
perl-Tie
Amazon Linux 2023
0:4.6-477.amzn2023.0.5
fixed
perl-Tie-File
Amazon Linux 2023
0:1.06-477.amzn2023.0.5
fixed
perl-Tie-Memoize
Amazon Linux 2023
0:1.1-477.amzn2023.0.5
fixed
perl-Time
Amazon Linux 2023
0:1.03-477.amzn2023.0.5
fixed
perl-Time-Piece
Amazon Linux 2023
0:1.3401-477.amzn2023.0.5
fixed
perl-Time-Piece-debuginfo
Amazon Linux 2023
0:1.3401-477.amzn2023.0.5
fixed
perl-Unicode-UCD
Amazon Linux 2023
0:0.75-477.amzn2023.0.5
fixed
perl-User-pwent
Amazon Linux 2023
0:1.03-477.amzn2023.0.5
fixed
perl-autouse
Amazon Linux 2023
0:1.11-477.amzn2023.0.5
fixed
perl-base
Amazon Linux 2023
0:2.27-477.amzn2023.0.5
fixed
perl-blib
Amazon Linux 2023
0:1.07-477.amzn2023.0.5
fixed
perl-debugger
Amazon Linux 2023
0:1.56-477.amzn2023.0.5
fixed
perl-debuginfo
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-debugsource
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-deprecate
Amazon Linux 2023
0:0.04-477.amzn2023.0.5
fixed
perl-devel
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-diagnostics
Amazon Linux 2023
0:1.37-477.amzn2023.0.5
fixed
perl-doc
Amazon Linux 2023
0:5.32.1-477.amzn2023.0.5
fixed
perl-encoding-warnings
Amazon Linux 2023
0:0.13-477.amzn2023.0.5
fixed
perl-fields
Amazon Linux 2023
0:2.27-477.amzn2023.0.5
fixed
perl-filetest
Amazon Linux 2023
0:1.03-477.amzn2023.0.5
fixed
perl-if
Amazon Linux 2023
0:0.60.800-477.amzn2023.0.5
fixed
perl-interpreter
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-interpreter-debuginfo
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-less
Amazon Linux 2023
0:0.03-477.amzn2023.0.5
fixed
perl-lib
Amazon Linux 2023
0:0.65-477.amzn2023.0.5
fixed
perl-libnetcfg
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-libs
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-libs-debuginfo
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-locale
Amazon Linux 2023
0:1.09-477.amzn2023.0.5
fixed
perl-macros
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-meta-notation
Amazon Linux 2023
0:5.32.1-477.amzn2023.0.5
fixed
perl-mro
Amazon Linux 2023
0:1.23-477.amzn2023.0.5
fixed
perl-mro-debuginfo
Amazon Linux 2023
0:1.23-477.amzn2023.0.5
fixed
perl-open
Amazon Linux 2023
0:1.12-477.amzn2023.0.5
fixed
perl-overload
Amazon Linux 2023
0:1.31-477.amzn2023.0.5
fixed
perl-overloading
Amazon Linux 2023
0:0.02-477.amzn2023.0.5
fixed
perl-ph
Amazon Linux 2023
0:5.32.1-477.amzn2023.0.5
fixed
perl-sigtrap
Amazon Linux 2023
0:1.09-477.amzn2023.0.5
fixed
perl-sort
Amazon Linux 2023
0:2.04-477.amzn2023.0.5
fixed
perl-subs
Amazon Linux 2023
0:1.03-477.amzn2023.0.5
fixed
perl-tests
Amazon Linux 2023
4:5.32.1-477.amzn2023.0.5
fixed
perl-utils
Amazon Linux 2023
0:5.32.1-477.amzn2023.0.5
fixed
perl-vars
Amazon Linux 2023
0:1.05-477.amzn2023.0.5
fixed
perl-vmsish
Amazon Linux 2023
0:1.04-477.amzn2023.0.5
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
perl
CBL-Mariner 1.0
0:5.30.3-3.cm1
fixed
CBL-Mariner 2.0
0:5.34.1-489.cm2
fixed
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2023/04/29/1
http://www.openwall.com/lists/oss-security/2023/05/03/3
http://www.openwall.com/lists/oss-security/2023/05/03/5
http://www.openwall.com/lists/oss-security/2023/05/07/2
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
https://github.com/chansen/p5-http-tiny/pull/153
https://hackeriet.github.io/cpan-http-tiny-overview/
https://www.openwall.com/lists/oss-security/2023/04/18/14
https://www.openwall.com/lists/oss-security/2023/05/03/4
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
http://www.openwall.com/lists/oss-security/2023/04/29/1
http://www.openwall.com/lists/oss-security/2023/05/03/3
http://www.openwall.com/lists/oss-security/2023/05/03/5
http://www.openwall.com/lists/oss-security/2023/05/07/2
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
https://github.com/chansen/p5-http-tiny/pull/153
https://hackeriet.github.io/cpan-http-tiny-overview/
https://security.netapp.com/advisory/ntap-20241129-0011/
https://www.openwall.com/lists/oss-security/2023/04/18/14
https://www.openwall.com/lists/oss-security/2023/05/03/4
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/