CVE-2020-16156: perl-base - Bypass of verification of signatures in CHECKSUMS files
Summary
CVE-2020-16156: CPAN 2.28 allows Signature Verification Bypass. Affects perl versions < 5.32.1-4+deb11u4. Fixed in 5.32.1-4+deb11u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
perl-base is a package that provides the core Perl programming language interpreter. It is widely used for scripting, system administration, and web development. This vulnerability affects perl-base version 5.24.1-3+deb9u4. The package is responsible for verifying signatures in CHECKSUMS files, which are used to ensure the integrity of downloaded files from CPAN (Comprehensive Perl Archive Network).
Vulnerability Detail
The CPAN version 2.28 allows for a Signature Verification Bypass vulnerability. This means that an attacker can bypass the signature verification process and potentially tamper with the downloaded files from CPAN. This could lead to the installation of malicious or modified packages, compromising the integrity and security of the Perl environment. The vulnerability has a CVSS score of 7.8, indicating a high severity level.
How To Fix
Minimum fixed version
5.32.1-4+deb11u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to apply the recommended fix by updating perl-base to a patched version.
Conclusion
The CVE-2020-16156 vulnerability in perl-base allows for a bypass of signature verification in CHECKSUMS files. This could lead to the installation of malicious or modified packages from CPAN. It is crucial to update perl-base to a patched version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for perl →
FAQ
perl-base is the core Perl programming language interpreter package. It provides the foundation for Perl scripting, system administration, and web development.
CPAN (Comprehensive Perl Archive Network) is a repository of Perl modules and libraries. It allows users to easily download and install Perl packages for various purposes.
If you are using perl-base version 5.24.1-3+deb9u4, this vulnerability could allow an attacker to bypass signature verification and potentially compromise the integrity and security of your Perl environment.
The CVSS score of this vulnerability is 7.8, indicating a high severity level.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for perl.
