CVE-2024-45321
Description
A flaw was found in App::cpanminus (cpanm) through version 1.7047. The default configuration downloads Perl modules from CPAN using HTTP, which could allow an attacker to view or modify the content without the knowledge of the user. This issue could allow an attacker to execute malicious code if they have the ability to intercept and modify the content before it reaches to user.
Mitigation
A user can force cpanminus to use a HTTPS mirror using the --from command-line argument. This can be configured as a CLI option or as an environment variable.
As a command line argument, replacing DISTNAME in the command with the name of the distribution you want to install:
`$ cpanm --from https://www.cpan.org DISTNAME`
As set with the environment variable:
`$ export PERL_CPANM_OPT="--from https://www.cpan.org";`
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.1 | 8.1 | 9.8 |
| Attack Vector | Network | Network | Network |
| Attack Complexity | High | High | Low |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | High | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
This whole attack is based on the assumption that a non encrypted HTTP connection to CPAN could be hijacked. While this is true, the complexity of the attack is high as the attacker would need another vulnerability to hijack the connection. perl-App-cpanminus can not be manipulated to hijack the session. The attacker would either need an independent mechanism to compromise the host system, or get access to the routing infrastructure to make it happen. Thereby the AC as per RH should be H instead of L as per NVD.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
