Summary
It was discovered that App::cpanminus did not properly verify CHECKSUMS files.
An attacker could possibly use this issue to bypass signature verification,
gaining access to sensitive data or possibly executing unauthorized code.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | cpanminus | 1.7040-1ubuntu0.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | cpanminus | 1.7043-1ubuntu0.1~esm1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | cpanminus | 1.7044-1ubuntu0.1~esm1 |
Vulnerabilities 1
-
Unscored —
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
References
-
report
https://ubuntu.com/security/CVE-2020-16154