CVE-2023-31486

2023-04-2900:00:00

ubuntu.com

http::tiny

tls configuration

certificate verification

cpan

perl

debian

bug

metacpan

ssl

regression

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

0.003 Low

EPSS

Percentile

68.9%

JSON

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available
standalone on CPAN, has an insecure default TLS configuration where users
must opt in to verify certificates.

Bugs

Notes

Author	Note
ccdm94	It seems like upstream will not be fixing this issue due to the large risk that it might break things and in order to maintain backwards compatibility. As per the information available in https://metacpan.org/pod/HTTP::Tiny#SSL-SUPPORTIt, HTTP:Tiny aims to not make assumptions about trust models chosen by users, and, therefore, according to the documentation and upstream’s position regarding this issue (see p5-http-tiny issues 68 and 134), it is recommended that users set the verify_SSL option in their own code in order to apply certificate verification functionalities to their applications. Due to the risk of this issue introducing regressions and all that has been mentioned up to this point, releases will be marked as ignored.

Author

Note

ccdm94

It seems like upstream will not be fixing this issue due to the large risk that it might break things and in order to maintain backwards compatibility. As per the information available in https://metacpan.org/pod/HTTP::Tiny#SSL-SUPPORTIt, HTTP:Tiny aims to not make assumptions about trust models chosen by users, and, therefore, according to the documentation and upstream’s position regarding this issue (see p5-http-tiny issues 68 and 134), it is recommended that users set the verify_SSL option in their own code in order to apply certificate verification functionalities to their applications. Due to the risk of this issue introducing regressions and all that has been mentioned up to this point, releases will be marked as ignored.