CVE-2023-31484

Name of the Vulnerable Software and Affected Versions CPAN.pm versions prior to 2.35

Description The issue is related to errors in the TLS certificate authentication procedure, which can allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem stems from the failure to verify TLS certificates when downloading distributions over HTTPS. This can lead to a man-in-the-middle attack, where an attacker could gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.

Recommendations For versions prior to 2.35, update to version 2.35 or later to resolve the issue. As a temporary workaround, consider disabling the use of HTTPS for distribution downloads until a patch is available. Restrict access to sensitive information and communication channels to minimize the risk of exploitation.