CVE-2023-31486
http-tiny: insecure TLS cert default
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
A vulnerability was found in Tiny, where a Perl core module and standalone CPAN package, does not verify TLS certificates by default. Users need to explicitly enable certificate verification with the verify_SSL=>1 flag to ensure secure HTTPS connections. This oversight can potentially expose applications to man-in-the-middle (MITM) attacks, where an attacker might intercept and manipulate data transmitted between the client and server.
Multiple vulnerabilities have been discovered in Perl, the worst of which can lead to arbitrary code execution. Versions greater than or equal to 5.38.2 are affected.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2023-04-28 CVE Reserved
- 2023-04-28 CVE Published
- 2025-01-30 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-295: Improper Certificate Validation
- CWE-1188: Initialization of a Resource with an Insecure Default
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2023/05/03/5 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2023/05/07/2 | Mailing List |
|
| https://hackeriet.github.io/cpan-http-tiny-overview | Product | |
| https://www.openwall.com/lists/oss-security/2023/05/03/4 | Mailing List |
|
| https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-31486 | 2024-07-09 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2228392 | 2024-07-09 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Http::tiny Project Search vendor "Http::tiny Project" | Http::tiny Search vendor "Http::tiny Project" for product "Http::tiny" | < 0.083 Search vendor "Http::tiny Project" for product "Http::tiny" and version " < 0.083" | - |
Affected
| ||||||
| Perl Search vendor "Perl" | Perl Search vendor "Perl" for product "Perl" | < 5.38.0 Search vendor "Perl" for product "Perl" and version " < 5.38.0" | - |
Affected
| ||||||