ALT-PU-2023-7616-2
Closed vulnerabilities
Published: 2023-02-28
BDU:2023-03871
Уязвимость компонента CPAN.pm языка программирования Perl, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity: HIGH (8.1)
Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2023-04-29
BDU:2023-03872
Уязвимость библиотеки языка программирования Perl HTTP::Tiny, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
Severity: HIGH (8.1)
Vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
Published: 2023-04-29
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2023-31484
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
Severity: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20230429 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230507 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/andk/cpanpm/pull/175
- FEDORA-2023-1e5af38524
- FEDORA-2023-46924e402a
- https://metacpan.org/dist/CPAN/changes
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- [oss-security] 20230429 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://metacpan.org/dist/CPAN/changes
- FEDORA-2023-46924e402a
- FEDORA-2023-1e5af38524
- https://github.com/andk/cpanpm/pull/175
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- [oss-security] 20230507 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
Published: 2023-04-29
Modified: 2025-01-30
Modified: 2025-01-30
CVE-2023-31486
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
Severity: HIGH (8.1)
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- [oss-security] 20230429 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230429 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230507 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- [oss-security] 20230507 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://security.netapp.com/advisory/ntap-20241129-0011/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
Closed bugs
Не хватает provides perl-Data-Dumper