USN-5230-1: App::cpanminus vulnerability
24 January 2022
App::cpanminus could be made to bypass signature verification if it received specially crafted input.
Releases
Packages
- cpanminus - script to get, unpack, build and install modules from CPAN
Details
It was discovered that App::cpanminus did not properly verify CHECKSUMS files.
An attacker could possibly use this issue to bypass signature verification,
gaining access to sensitive data or possibly executing unauthorized code.
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
-
cpanminus
-
1.7044-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 18.04
-
cpanminus
-
1.7043-1ubuntu0.1~esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
cpanminus
-
1.7040-1ubuntu0.1~esm1
Available with Ubuntu Pro
After a standard system update, configure App::cpanminus to use only trusted
CPAN mirrors over HTTPS using the option on the command line or
environment variable.