PT-2021-9867 · Unknown+2 · Cpan::Checksums+2

Stig Palmquist · Published 2021-11-26 · Updated 2025-01-30 · CVE-2020-16155

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions CPAN::Checksums version 2.12

Description The issue concerns the CPAN::Checksums package for Perl, which does not uniquely define signed data. This could potentially lead to security issues, although specific details about exploitation or affected devices are not provided.

Recommendations For CPAN::Checksums version 2.12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

ALT-PU-2021-3372

ALT-PU-2025-2129

CVE-2020-16155

Affected Products

Alt Linux

Cpan::Checksums

Debian

References · 11

• 🔥 https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-16155 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-16155 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16155 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-16155 · Security Note
• https://ubuntu.com/security/CVE-2020-16155 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-16155 · Vendor Advisory
• https://t.me/cibsecurity/33867 · Telegram Post
• http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html · Note
• https://metacpan.org/pod/CPAN::Checksums · Note