CVE-2013-2145
Severity Score
4.4
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
2
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
La funcionalidad de verificación cpansign en el módulo Module::Signature anterior a 0.72 para Perl, permite a atacantes evitar la comprobación de firma y ejecutar código arbitrarioa través de un archivo SIGNATURE con "un cifrado desconocido especial" que referencia a un módulo no confiable en Digest/.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-02-19 CVE Reserved
- 2013-06-27 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/06/05/16 | Mailing List |
|
| http://www.securityfocus.com/bid/60352 | Vdb Entry | |
| https://bugzilla.redhat.com/show_bug.cgi?id=971096 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2013-07/msg00039.html | 2018-10-30 | |
| http://lists.opensuse.org/opensuse-updates/2013-07/msg00043.html | 2018-10-30 | |
| http://www.ubuntu.com/usn/USN-1896-1 | 2018-10-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 13.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "13.04" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 11.4 Search vendor "Opensuse" for product "Opensuse" and version "11.4" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 12.2 Search vendor "Opensuse" for product "Opensuse" and version "12.2" | - |
Affected
| ||||||
| Opensuse Search vendor "Opensuse" | Opensuse Search vendor "Opensuse" for product "Opensuse" | 12.3 Search vendor "Opensuse" for product "Opensuse" and version "12.3" | - |
Affected
| ||||||
| Perlmonks Search vendor "Perlmonks" | Module::signature Search vendor "Perlmonks" for product "Module::signature" | <= 0.72 Search vendor "Perlmonks" for product "Module::signature" and version " <= 0.72" | perl |
Affected
| ||||||
| Perlmonks Search vendor "Perlmonks" | Module::signature Search vendor "Perlmonks" for product "Module::signature" | 0.70 Search vendor "Perlmonks" for product "Module::signature" and version "0.70" | perl |
Affected
| ||||||
| Perlmonks Search vendor "Perlmonks" | Module::signature Search vendor "Perlmonks" for product "Module::signature" | 0.71 Search vendor "Perlmonks" for product "Module::signature" and version "0.71" | perl |
Affected
| ||||||