Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-31484: HTTP::Tiny 0.082, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | perl-CPAN | 0:2.34-1.amzn2023.0.3 |
| Amazon Linux · 2023 | perl-CPAN-tests | 0:2.34-1.amzn2023.0.3 |
Vulnerabilities 1
-
High 8.1
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-31484.html