CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 1CVE-2023-31484 – perl: CPAN.pm does not verify TLS certificates when downloading distributions over HTTPS
https://notcve.org/view.php?id=CVE-2023-31484
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. A flaw was found in Perl's CPAN, which doesn't check TLS certificates when downloading content. This happens due to `verify_SSL` missing when suing the `HTTP::Tiny` library during the connection. This may allow an attacker to inject into the network path and perform a Man-In-The-Middle attack, causing confidentiality or integrity issues. • http://www.openwall.com/lists/oss-security/2023/04/29/1 http://www.openwall.com/lists/oss-security/2023/05/03/3 http://www.openwall.com/lists/oss-security/2023/05/03/5 http://www.openwall.com/lists/oss-security/2023/05/07/2 https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules https://github.com/andk/cpanpm/pull/175 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL https:& • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 2CVE-2020-16156
https://notcve.org/view.php?id=CVE-2020-16156
CPAN 2.28 allows Signature Verification Bypass. CPAN versión 2.28, permite una Omisión de Verificación de Firmas • http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC https://metacpan.org/pod/distribution/CPAN/scripts/cpan • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-36770
https://notcve.org/view.php?id=CVE-2021-36770
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value. Encode.pm, distribuido en Perl versiones hasta 5.34.0, permite a usuarios locales alcanzar privilegios por medio de una biblioteca Encode::ConfigLocal (en el directorio de trabajo actual) que se adelanta a una carga dinámica de módulos. Una explotación requiere una configuración inusual, y determinadas versiones 2021 de Encode.pm (3.05 hasta 3.11). • https://github.com/Perl/perl5/commit/c1a937fef07c061600a0078f4cb53fe9c2136bb9 https://github.com/dankogai/p5-encode/commit/527e482dc70b035d0df4f8c77a00d81f8d775c74 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NDGQSGMEZ75FJGBKNYC75OTO7TF7XHB https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6KOZYD7BH2DNIAEZ2ZL4PJ4QUVQI6Y33 https://metacpan.org/dist/Encode/changes https://news.cpanel.com/unscheduled-tsr-10-august-2021 https://security-tracker.debian.org/tracker • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-17478
https://notcve.org/view.php?id=CVE-2020-17478
ECDSA/EC/Point.pm in Crypt::Perl before 0.33 does not properly consider timing attacks against the EC point multiplication algorithm. El archivo ECDSA/EC/Point.pm en Crypt::Perl versiones anteriores a 0.33, no considera apropiadamente los ataques de sincronización contra el algoritmo de multiplicación de puntos EC • https://github.com/FGasper/p5-Crypt-Perl/compare/0.32...0.33 • CWE-203: Observable Discrepancy •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-13895
https://notcve.org/view.php?id=CVE-2020-13895
Crypt::Perl::ECDSA in the Crypt::Perl (aka p5-Crypt-Perl) module before 0.32 for Perl fails to verify correct ECDSA signatures when r and s are small and when s = 1. This happens when using the curve secp256r1 (prime256v1). This could conceivably have a security-relevant impact if an attacker wishes to use public r and s values when guessing whether signature verification will fail. La función Crypt::Perl::ECDSA en el módulo Crypt::Perl (también se conoce como p5-Crypt-Perl) versiones anteriores a 0.32 para Perl, no puede verificar las firmas correctas ECDSA cuando r y s son pequeñas y cuando s = 1. Esto se presenta cuando se usa la curva secp256r1 (prime256v1). • https://github.com/FGasper/p5-Crypt-Perl/commit/f960ce75502acf7404187231a706672f8369acb2 https://github.com/FGasper/p5-Crypt-Perl/issues/14 • CWE-347: Improper Verification of Cryptographic Signature •