Summary
It was discovered that Perl was not properly verifying TLS certificates
when using CPAN together with HTTP::Tiny to download modules over HTTPS.
If a remote attacker were able to intercept communications, this flaw
could potentially be used to install altered modules.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 18.04 LTS 18.04:LTS | perl | 5.26.1-6ubuntu0.7 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | perl | 5.18.2-2ubuntu1.7+esm5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | perl | 5.22.1-9ubuntu0.9+esm2 |
Vulnerabilities 1
-
High 8.1
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
References
-
report
https://ubuntu.com/security/CVE-2023-31484