Описание
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
A flaw was found in App::cpanminus (cpanm) through version 1.7047. The default configuration downloads Perl modules from CPAN using HTTP, which could allow an attacker to view or modify the content without the knowledge of the user. This issue could allow an attacker to execute malicious code if they have the ability to intercept and modify the content before it reaches to user.
Меры по смягчению последствий
A user can force cpanminus to use a HTTPS mirror using the --from command-line argument. This can be configured as a CLI option or as an environment variable.
As a command line argument, replacing DISTNAME in the command with the name of the distribution you want to install:
$ cpanm --from https://www.cpan.org DISTNAME
As set with the environment variable:
$ export PERL_CPANM_OPT="--from https://www.cpan.org"
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | perl-App-cpanminus | Not affected | ||
| Red Hat Enterprise Linux 7 | perl-App-cpanminus | Affected | ||
| Red Hat Enterprise Linux 8 | perl-App-cpanminus | Will not fix | ||
| Red Hat Enterprise Linux 8 | perl-App-cpanminus | Fixed | RHSA-2024:10219 | 25.11.2024 |
| Red Hat Enterprise Linux 9 | perl-App-cpanminus | Fixed | RHSA-2024:10218 | 25.11.2024 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.1 High
CVSS3
Связанные уязвимости
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
The App::cpanminus package through 1.7047 for Perl downloads code via ...
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
ELSA-2024-10219: perl-App-cpanminus:1.7044 security update (MODERATE)
EPSS
8.1 High
CVSS3