CVE-2020-16156
Published: 13 December 2021
CPAN 2.28 allows Signature Verification Bypass.
Notes
Author | Note |
---|---|
rayveldkamp | Fix is in cpanpm 2.29 |
leosilva | using only ensured identified https mirrors could be a solution, as even perl modules if a trusted server is used its identity will be verified even in the absense of perl-module-signature. |
Priority
Status
Severity score breakdown
Parameter | Value |
---|---|
Base score | 7.8 |
Attack vector | Local |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
- https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
- http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
- https://ubuntu.com/security/notices/USN-5689-1
- https://ubuntu.com/security/notices/USN-5689-2
- NVD
- Launchpad
- Debian