CVE-2020-16156
First published: Mon Dec 13 2021(Updated: )
CPAN 2.28 allows Signature Verification Bypass.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Perl Comprehensive Perl Archive Network | =2.28 | |
| Perl Comprehensive Perl Archive Network | =2.28-trial | |
| Fedoraproject Fedora | =34 | |
| Fedoraproject Fedora | =35 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
- https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
- https://metacpan.org/pod/distribution/CPAN/scripts/cpan
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
Frequently Asked Questions
What is CVE-2020-16156?
CVE-2020-16156 refers to a vulnerability in CPAN 2.28 that allows Signature Verification Bypass.
How severe is CVE-2020-16156?
CVE-2020-16156 has a severity rating of 7.8, which is considered high.
Which software versions are affected by CVE-2020-16156?
CPAN version 2.28 and CPAN version 2.28-trial are affected by CVE-2020-16156.
Is there a fix for CVE-2020-16156?
Yes, there are fixes available for CVE-2020-16156.
Where can I find more information about CVE-2020-16156?
You can find more information about CVE-2020-16156 in the references provided: [1](http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html), [2](https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/), [3](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/)
- collector/nvd-index
- agent/severity
- agent/author
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- vendor/perl
- canonical/perl comprehensive perl archive network
- version/perl comprehensive perl archive network/2.28
- version/perl comprehensive perl archive network/2.28-trial
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/34
- version/fedoraproject fedora/35