ALT-PU-2021-3373-1
Closed vulnerabilities
Published: 2020-07-08
BDU:2023-01694
Уязвимость функции Module::Signature::_verify() языка программирования Perl, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: CRITICAL (9.3)
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C
References:
Published: 2021-12-13
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2020-16156
CPAN 2.28 allows Signature Verification Bypass.
Severity: MEDIUM (6.8)
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Severity: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References:
- http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
- https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
- https://metacpan.org/pod/distribution/CPAN/scripts/cpan
- http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
- https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
- https://metacpan.org/pod/distribution/CPAN/scripts/cpan