CVE-2024-45321 - perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability

Back Back to CVE browser

CRITICAL

perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability

Published Aug 27, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.74%

Description

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

Affected products

Vendor Perl Product Cpanminus Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <=1.7047

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Perl

Cpanminus

n/a

Version	Status	Constraints
0	affected	<=1.7047

Red Hat Enterprise Linux 8

perl-App-cpanminus:1.7044-8100020241029121948.3b7a67e1

Fixed · RHSA-2024:10219
Red Hat Enterprise Linux 9

perl-App-cpanminus-0:1.7044-14.1.el9_5

Fixed · RHSA-2024:10218
Red Hat Enterprise Linux 10

perl-App-cpanminus

Not affected
Red Hat Enterprise Linux 7

perl-App-cpanminus

Affected
Red Hat Enterprise Linux 8

perl-App-cpanminus

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 8	perl-App-cpanminus:1.7044-8100020241029121948.3b7a67e1	Fixed	RHSA-2024:10219
Red Hat Enterprise Linux 9	perl-App-cpanminus-0:1.7044-14.1.el9_5	Fixed	RHSA-2024:10218
Red Hat Enterprise Linux 10	perl-App-cpanminus	Not affected	n/a
Red Hat Enterprise Linux 7	perl-App-cpanminus	Affected	n/a
Red Hat Enterprise Linux 8	perl-App-cpanminus	Will not fix	n/a

Remediation

Red Hat mitigation

A user can force cpanminus to use a HTTPS mirror using the --from command-line argument. This can be configured as a CLI option or as an environment variable. As a command line argument, replacing DISTNAME in the command with the name of the distribution you want to install: `$ cpanm --from https://www.cpan.org DISTNAME` As set with the environment variable: `$ export PERL_CPANM_OPT="--from https://www.cpan.org"`

Weaknesses (1)

CWE-494

References (8)

https://access.redhat.com/security/cve/CVE-2024-45321
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2308078
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41438
Advisory
https://github.com/miyagawa/cpanminus/issues/611
Issue Tracking
https://github.com/miyagawa/cpanminus/pull/674
Issue TrackingPatch
https://nvd.nist.gov/vuln/detail/CVE-2024-45321
https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html
ExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-45321

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2024-45321		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2308078		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-41438		Advisory
https://github.com/miyagawa/cpanminus/issues/611		Issue Tracking
https://github.com/miyagawa/cpanminus/pull/674		Issue TrackingPatch
https://nvd.nist.gov/vuln/detail/CVE-2024-45321
https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html		ExploitThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2024-45321