Vulnerability Details : CVE-2023-31484
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
Products affected by CVE-2023-31484
- cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*
- cpe:2.3:a:cpanpm_project:cpanpm:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-31484
0.33%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 72 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-31484
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
134c704f-9b21-4f2e-91b3-4a467353bcc0 | 2024-08-01 |
|
8.1
|
HIGH | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.2
|
5.9
|
NIST |
CWE ids for CVE-2023-31484
-
The product does not validate, or incorrectly validates, a certificate.Assigned by:
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
- nvd@nist.gov (Primary)
References for CVE-2023-31484
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
[SECURITY] Fedora 38 Update: perl-CPAN-2.36-1.fc38 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
Perl's HTTP::Tiny has insecure TLS default, affecting CPAN.pm and other modules – Hackeriet BlogMitigation;Patch;Third Party Advisory
-
https://security.netapp.com/advisory/ntap-20240621-0007/
May 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
[SECURITY] Fedora 37 Update: perl-CPAN-2.36-1.fc37 - package-announce - Fedora Mailing-ListsThird Party Advisory
-
https://www.openwall.com/lists/oss-security/2023/04/18/14
oss-security - Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Patch
-
http://www.openwall.com/lists/oss-security/2023/05/03/5
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List
-
http://www.openwall.com/lists/oss-security/2023/05/03/3
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Patch
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
[SECURITY] Fedora 38 Update: perl-CPAN-2.36-1.fc38 - package-announce - Fedora Mailing-Lists
-
https://github.com/andk/cpanpm/pull/175
Add verify_SSL=>1 to HTTP::Tiny in CPAN::HTTP::Client to verify https server identity by stigtsp · Pull Request #175 · andk/cpanpm · GitHubExploit;Issue Tracking
-
https://metacpan.org/dist/CPAN/changes
Changes - metacpan.orgRelease Notes
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
[SECURITY] Fedora 37 Update: perl-CPAN-2.36-1.fc37 - package-announce - Fedora Mailing-Lists
-
http://www.openwall.com/lists/oss-security/2023/04/29/1
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List;Patch
-
http://www.openwall.com/lists/oss-security/2023/05/07/2
oss-security - Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modulesMailing List
Jump to