CVE-2020-16156
Published: 13 December 2021
CPAN 2.28 allows Signature Verification Bypass.
Notes
Author | Note |
---|---|
rayveldkamp | Fix is in cpanpm 2.29 |
leosilva | using only ensured identified https mirrors could be a solution, as even perl modules if a trusted server is used its identity will be verified even in the absense of perl-module-signature. |
Priority
CVSS 3 base score: 7.8
Status
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16156
- https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
- http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
- https://ubuntu.com/security/notices/USN-5689-1
- https://ubuntu.com/security/notices/USN-5689-2
- NVD
- Launchpad
- Debian