CVE-2020-16156: High severity comprehensive perl archive network vulnerability
CPAN 2.28 allows Signature Verification Bypass.
Other sources
It was found that cpan and cpanm are vulnerable to a signature verification bypass. Additionally, CPAN::Checksums (used by PAUSE) does not uniquely identify packages in the signed CHECKSUMS file, enabling a supply chain attack.
Reference:
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-16156?
CVE-2020-16156 refers to a vulnerability in CPAN 2.28 that allows Signature Verification Bypass.
How severe is CVE-2020-16156?
CVE-2020-16156 has a severity rating of 7.8, which is considered high.
Which software versions are affected by CVE-2020-16156?
CPAN version 2.28 and CPAN version 2.28-trial are affected by CVE-2020-16156.
Is there a fix for CVE-2020-16156?
Yes, there are fixes available for CVE-2020-16156.
Where can I find more information about CVE-2020-16156?
You can find more information about CVE-2020-16156 in the references provided: [1](http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html), [2](https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/), [3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/)