CVE-2023-31486
Severity CVSS v4.0:
Pending analysis
Type:
CWE-295
Improper Certificate Validation
Publication date:
29/04/2023
Last modified:
30/01/2025
Description
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
Impact
Base Score 3.x
8.10
Severity 3.x
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:http\:\:tiny_project:http\:\:tiny:*:*:*:*:*:*:*:* | 0.083 (excluding) | |
| cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* | 5.38.0 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.openwall.com/lists/oss-security/2023/04/29/1
- http://www.openwall.com/lists/oss-security/2023/05/03/3
- http://www.openwall.com/lists/oss-security/2023/05/03/5
- http://www.openwall.com/lists/oss-security/2023/05/07/2
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
- http://www.openwall.com/lists/oss-security/2023/04/29/1
- http://www.openwall.com/lists/oss-security/2023/05/03/3
- http://www.openwall.com/lists/oss-security/2023/05/03/5
- http://www.openwall.com/lists/oss-security/2023/05/07/2
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://security.netapp.com/advisory/ntap-20241129-0011/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/