CVE-2023-31486

Опубликовано: 29 апр. 2023

Источник: nvd

CVSS3: 8.1

EPSS Низкий

Описание

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

Ссылки

http://www.openwall.com/lists/oss-security/2023/04/29/1
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2023/05/03/3
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2023/05/03/5
Mailing List
http://www.openwall.com/lists/oss-security/2023/05/07/2
Mailing List
Third Party Advisory
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
Mitigation
Patch
Third Party Advisory
https://github.com/chansen/p5-http-tiny/pull/153
Patch
https://hackeriet.github.io/cpan-http-tiny-overview/
Product
https://www.openwall.com/lists/oss-security/2023/04/18/14
Mailing List
Patch
https://www.openwall.com/lists/oss-security/2023/05/03/4
Mailing List
Third Party Advisory
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
Issue Tracking
http://www.openwall.com/lists/oss-security/2023/04/29/1
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2023/05/03/3
Mailing List
Patch
http://www.openwall.com/lists/oss-security/2023/05/03/5
Mailing List
http://www.openwall.com/lists/oss-security/2023/05/07/2
Mailing List
Third Party Advisory
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
Mitigation
Patch
Third Party Advisory
https://github.com/chansen/p5-http-tiny/pull/153
Patch
https://hackeriet.github.io/cpan-http-tiny-overview/
Product
https://security.netapp.com/advisory/ntap-20241129-0011/
https://www.openwall.com/lists/oss-security/2023/04/18/14
Mailing List
Patch
https://www.openwall.com/lists/oss-security/2023/05/03/4
Mailing List
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:http\:\:tiny_project:http\:\:tiny:*:*:*:*:*:*:*:*

Версия до 0.083 (исключая)

Конфигурация 2

cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:*

Версия до 5.38.0 (исключая)

EPSS

Процентиль: 63%

0.00448

Низкий

8.1 High

CVSS3

Дефекты

CWE-295

Связанные уязвимости

CVE-2023-31486

CVSS3: 8.1

ubuntu

больше 2 лет назад

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

CVE-2023-31486

CVSS3: 8.1

redhat

больше 2 лет назад

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

CVE-2023-31486

CVSS3: 8.1

msrc

около 2 лет назад

Описание отсутствует

CVE-2023-31486

CVSS3: 8.1

debian

больше 2 лет назад

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available ...

openSUSE-SU-2023:0223-1

suse-cvrf

около 2 лет назад

Security update for perl-HTTP-Tiny

EPSS

Процентиль: 63%

0.00448

Низкий

8.1 High

CVSS3

Дефекты

CWE-295