Debian alert DLA-3926-1 (perl)

From:
             
 
Guilhem Moulin <guilhem@debian.org>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 3926-1] perl security update
Date:
             
 
Mon, 21 Oct 2024 16:15:01 +0200
Message-ID:
             
 
<ZxZh5eNEQThPxbSL@debian.org>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3926-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
October 21, 2024                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : perl
Version        : 5.32.1-4+deb11u4
CVE ID         : CVE-2020-16156 CVE-2023-31484
Debian Bug     : 1015985 1035109

Vulnerabilities were found in Perl's CPAN.pm, which could lead CPAN
clients to install malicious modules.

CVE-2020-16156

    Stig Palmquist discovered that an attacker can prepend checksums for
    modified packages to the beginning of CHECKSUMS files, before the
    cleartext PGP headers, resulting in signature verification bypass.

    CPAN.pm has been updated so that when configured to validate the
    signature on CHECKSUMS, it will refuse to install a tarball if the
    associated CHECKSUMS file isn't signed.  The gpg(1) executable is
    required in order to validate signatures.

CVE-2023-31484

    Stig Palmquist discovered that CPAN::HTTP::Client did not verify
    X.509 certificates in the HTTP::Tiny call, which could allows an
    attacker to MITM the connection with the CPAN mirror.

    CPAN::HTTP::Client now enables the `verify_SSL` flag.  HTTPS mirrors
    therefore require a valid certificate.  The identity of the default
    mirror https://cpan.org can be verified after installing the
    'ca-certificates' package.

For Debian 11 bullseye, these problems have been fixed in version
5.32.1-4+deb11u4.

We recommend that you upgrade your perl packages.

For the detailed security status of perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/perl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmcWYeUACgkQ05pJnDwh
pVJdSg//Vys2D0cHrAetofGGptIcV7NZc9QatR3Cbk+FL0hlzuWUhIYzvhnKnzQF
2c+UKDaX7UDWJUvLtBgLicp9611jDj6d2sGKYJVrTCiETTEPlNEeIS+hb6yE8KTJ
U/iDAsx+yfOkL3H6cLZ3NyqrnlrvsN9PNWnBE+mfbpf+lSc+ahElnQkvJ5yZHHeE
IiRAF08y5V35s+V1B3EVUj3Dp5AMpFP0sNglESkxwSvAex72BUfuacUlq81MbyHJ
J1m1SC60ItnLZ2b9nWFnFk6EJSIp5Tv4R7IeX7SY0MNV3b1uIhp294VezZKbUVI2
n6syLmoBk0Wi4xO6zRyZ8f9ySIjllR4GB9BMd1DlEEXiyWcMPoUp2XnhhGq4EI6p
KK0PYJ4BHymmPvjof1KZXdfT+p+k5sKeTp5oc59e+Tu9tpNVhlAAwhDGR6HOJp6S
VavSk603W0iZa3blMLtP5vTn6e1nti4FBDOiEe20gmnwu4PR2vnIJcIEgRPf3eb+
L74U7g9QpkKW87Mj3PZCMdevo/U306VSFP6/clyXS8qjnO0ZOkeOqY72rWrROYP+
aFHOBvtRz3HBEFIspOecFNJBvndIER48WB2JQEPB5EhBjoZecTa8A/xKKe+aGs29
HNlbrvVSxDUM0QqyFWmI1+3t1m3c/e49oTC7g3Hhoxm43kFtcgw=
=32QR
-----END PGP SIGNATURE-----