Data Signing Flaw in CPAN::Checksums Package by Perl
CVE-2020-16155

6.5MEDIUM

Key Information:

Vendor

Cpan\

Status
\
Vendor
CVE Published:
13 December 2021

What is CVE-2020-16155?

The CPAN::Checksums package version 2.12 for Perl has a security issue where it does not uniquely define signed data. This flaw can lead to potential integrity concerns within the software ecosystem, making it susceptible to attacks that exploit the weakness in data signing processes. It is crucial for developers and system administrators to address this vulnerability by ensuring that they implement appropriate checks or upgrade to a patched version to fortify their applications.

References

https://metacpan.org/pod/CPAN::Checksums
x_refsource_MISC
https://blog.hackeriet.no/cpan-signature-verification-vul...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.