What’s Vulnerable › Vulnerabilities

CVE-2023-31484

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-29 · updated 2026-06-17
• Weakness: CWE-295

Description

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

Affected products

• Cpanpm Project Cpanpm: before 2.35 — fixed in 2.35
• perl: before 5.38.0 — fixed in 5.38.0

How to fix

Upgrade to a fixed version: Cpanpm Project Cpanpm 2.35; perl 5.38.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/04/29/1
• http://www.openwall.com/lists/oss-security/2023/05/03/3
• http://www.openwall.com/lists/oss-security/2023/05/03/5
• http://www.openwall.com/lists/oss-security/2023/05/07/2
• https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
• https://github.com/andk/cpanpm/pull/175
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BM6UW55CNFUTNGD5ZRKGUKKKFDJGMFHL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LEGCEOKFJVBJ2QQ6S2H4NAEWTUERC7SB/
• https://metacpan.org/dist/CPAN/changes
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://www.openwall.com/lists/oss-security/2023/04/18/14
• http://www.openwall.com/lists/oss-security/2023/04/29/1

Get alerted when CVE-2023-31484 or the next vulnerability affects your stack