Base Score

HIGH8.1

CVE-2023-31484

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

VectorNETWORK

Published Bycve@mitre.org

Published DateApr 29, 2023, 00:15

Weakness Type (CWE):CWE-295

CVSS Metrics

Base Score

8.1

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH

References

http://www.openwall.com/lists/oss-security/2023/04/29/1
http://www.openwall.com/lists/oss-security/2023/05/03/3
http://www.openwall.com/lists/oss-security/2023/05/03/5
http://www.openwall.com/lists/oss-security/2023/05/07/2
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
https://github.com/andk/cpanpm/pull/175
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
https://metacpan.org/dist/CPAN/changes
https://security.netapp.com/advisory/ntap-20240621-0007/
https://www.openwall.com/lists/oss-security/2023/04/18/14
https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html

Base Score

HIGH8.1

Weakness Type (CWE):CWE-295

CVSS Metrics

Base Score

8.1

Vector String

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Severity

HIGH

Version

3.1

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

HIGH

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

HIGH

Integrity (I)

HIGH

Availability (A)

HIGH