------------------------------------------------------------------------- Debian LTS Advisory DLA-3926-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Guilhem Moulin October 21, 2024 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : perl Version : 5.32.1-4+deb11u4 CVE ID : CVE-2020-16156 CVE-2023-31484 Debian Bug : 1015985 1035109 Vulnerabilities were found in Perl's CPAN.pm, which could lead CPAN clients to install malicious modules. CVE-2020-16156 Stig Palmquist discovered that an attacker can prepend checksums for modified packages to the beginning of CHECKSUMS files, before the cleartext PGP headers, resulting in signature verification bypass. CPAN.pm has been updated so that when configured to validate the signature on CHECKSUMS, it will refuse to install a tarball if the associated CHECKSUMS file isn't signed. The gpg(1) executable is required in order to validate signatures. CVE-2023-31484 Stig Palmquist discovered that CPAN::HTTP::Client did not verify X.509 certificates in the HTTP::Tiny call, which could allows an attacker to MITM the connection with the CPAN mirror. CPAN::HTTP::Client now enables the `verify_SSL` flag. HTTPS mirrors therefore require a valid certificate. The identity of the default mirror https://cpan.org can be verified after installing the 'ca-certificates' package. For Debian 11 bullseye, these problems have been fixed in version 5.32.1-4+deb11u4. We recommend that you upgrade your perl packages. For the detailed security status of perl please refer to its security tracker page at: https://security-tracker.debian.org/tracker/perl Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature