CVE-2023-31486
Gravedad CVSS v3.1:
ALTA
Tipo:
CWE-295
Validación incorrecta de certificados
Fecha de publicación:
29/04/2023
Última modificación:
30/01/2025
Descripción
*** Pendiente de traducción *** HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.
Impacto
Puntuación base 3.x
8.10
Gravedad 3.x
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:http\:\:tiny_project:http\:\:tiny:*:*:*:*:*:*:*:* | 0.083 (excluyendo) | |
| cpe:2.3:a:perl:perl:*:*:*:*:*:*:*:* | 5.38.0 (excluyendo) |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://www.openwall.com/lists/oss-security/2023/04/29/1
- http://www.openwall.com/lists/oss-security/2023/05/03/3
- http://www.openwall.com/lists/oss-security/2023/05/03/5
- http://www.openwall.com/lists/oss-security/2023/05/07/2
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
- http://www.openwall.com/lists/oss-security/2023/04/29/1
- http://www.openwall.com/lists/oss-security/2023/05/03/3
- http://www.openwall.com/lists/oss-security/2023/05/03/5
- http://www.openwall.com/lists/oss-security/2023/05/07/2
- https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
- https://github.com/chansen/p5-http-tiny/pull/153
- https://hackeriet.github.io/cpan-http-tiny-overview/
- https://security.netapp.com/advisory/ntap-20241129-0011/
- https://www.openwall.com/lists/oss-security/2023/04/18/14
- https://www.openwall.com/lists/oss-security/2023/05/03/4
- https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/