cpan

About this tag
The tag cpan covers discussions about the Comprehensive Perl Archive Network, focusing on security and package management within the Perl ecosystem. A prominent thread addresses CVE-2023-31484, a TLS certificate verification flaw in CPAN.pm versions before 2.35 that left HTTPS downloads vulnerable to man-in-the-middle attacks. The fix, which enables explicit SSL verification, is critical for maintaining supply chain integrity when installing Perl modules. Topics include the impact on administrators and developers who rely on CPAN for distribution management, as well as best practices for updating to secure versions. The tag is relevant for Perl users concerned with secure software distribution and vulnerability remediation.

  1. CVE-2023-31484 CPAN.pm TLS Verification Flaw Fixed in 2.35

    A pervasive TLS certificate‑verification lapse in Perl’s CPAN.pm (tracked as CVE‑2023‑31484) left versions earlier than 2.35 trusting HTTPS downloads without validating server certificates — a simple oversight with serious supply‑chain consequences that was fixed by enabling explicit SSL...