PT-2023-3596 · Cpan.Pm+13 · Cpan.Pm+13
Stig Palmquist
·
Published
2023-02-28
·
Updated
2025-11-12
·
CVE-2023-31484
CVSS v3.1
8.1
High
| Vector | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CPAN.pm versions prior to 2.35
Description
The issue is related to errors in the TLS certificate authentication procedure, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem stems from the failure to verify TLS certificates when downloading distributions over HTTPS. This can lead to a man-in-the-middle attack, where an attacker could gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
Recommendations
For versions prior to 2.35, update to version 2.35 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS for distribution downloads until a patch is available. Restrict access to sensitive information and communication channels to minimize the risk of exploitation.
Exploit
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Cpan.Pm
Centos
Debian
Ibm Aix
Linuxmint
Apple Macos
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu