PT-2024-31572 · Unknown+6 · App::Cpanminus+6

Stig Palmquist · Published 2024-08-26 · Updated 2025-07-09 · CVE-2024-45321

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions App::cpanminus versions 1.7047 and earlier

Description The App::cpanminus package for Perl downloads code via insecure HTTP, enabling code execution for network attackers. This issue allows attackers to intercept traffic.

Recommendations For App::cpanminus versions 1.7047 and earlier, consider disabling the use of insecure HTTP downloads until a patch is available. As a temporary workaround, restrict access to the module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-494

Related Identifiers

ALSA-2024:10218

ALSA-2024:10219

ALT-PU-2024-13289

CESA-2024_10219

CVE-2024-45321

INFSA-2024_10218

INFSA-2024_10219

MGASA-2024-0339

OPENSUSE-SU-2024:14291-1

RHSA-2024:10218

RHSA-2024_10218

RHSA-2024_10219

RLSA-2024:10218

RLSA-2024:10219

Affected Products

Alt Linux

Almalinux

App::Cpanminus

Centos

Debian

Red Hat

Rocky Linux

References · 47

• 🔥 https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html · Exploit
• https://github.com/miyagawa/cpanminus/pull/674 · Patch
• https://errata.rockylinux.org/RLSA-2024:10218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-45321 · Security Note
• https://errata.almalinux.org/8/ALSA-2024-10219.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-10218.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-45321 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2024:10219 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2024-0339 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14291-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-45321 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2024:10219 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2024:10218 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2024-10219.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-45321 · Vendor Advisory