https://bugzilla.redhat.com/show_bug.cgi?id=2035273
Bug ID: 2035273 Summary: CVE-2020-16156 perl-CPAN: allows Signature Verification Bypass Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-t...@redhat.com Reporter: mre...@redhat.com CC: caswi...@redhat.com, hho...@redhat.com, jor...@redhat.com, jples...@redhat.com, kayc...@redhat.com, mspa...@redhat.com, perl-devel@lists.fedoraproject.org, perl-maint-l...@redhat.com, ppi...@redhat.com Target Milestone: --- Classification: Other It was found that cpan and cpanm are vulnerable to a signature verification bypass. Additionally, CPAN::Checksums (used by PAUSE) does not uniquely identify packages in the signed CHECKSUMS file, enabling a supply chain attack. Reference: https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/ -- You are receiving this mail because: You are on the CC list for the bug. https://bugzilla.redhat.com/show_bug.cgi?id=2035273 _______________________________________________ perl-devel mailing list -- perl-devel@lists.fedoraproject.org To unsubscribe send an email to perl-devel-le...@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/perl-devel@lists.fedoraproject.org Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure