Insecure TLS Configuration in libhttp-tiny-perl and perl Packages
Summary
DEBIAN-CVE-2023-31486: HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. Affects libhttp-tiny-perl versions < 0.088-1. Fixed in 0.088-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libhttp-tiny-perl is a Perl core module that provides a simple HTTP client interface. It is designed to be lightweight and easy to use, making it a popular choice for developers needing to make HTTP requests in their Perl applications. The vulnerability in question affects versions of this module prior to 0.083, where the default TLS configuration is insecure, requiring users to manually opt-in to verify certificates. This can lead to potential security risks if users are unaware of the need to enable certificate verification.
Vulnerability Detail
The vulnerability, identified as DEBIAN-CVE-2023-31486, originates from an insecure default TLS configuration in HTTP::Tiny before version 0.083. This issue allows for potential man-in-the-middle attacks, as users may unknowingly connect to untrusted servers without verifying their certificates. The vulnerability affects both the libhttp-tiny-perl and perl packages in Debian versions 13 and 14, with the risk of exposing sensitive data during HTTP transactions.
How To Fix
Minimum fixed version
0.088-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libhttp-tiny-perlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually enable certificate verification in their HTTP::Tiny configurations. This can be done by setting the 'verify' option to true in their HTTP requests, ensuring that certificates are checked before establishing a connection.
Conclusion
The vulnerability DEBIAN-CVE-2023-31486 highlights a significant security risk in the libhttp-tiny-perl and perl packages due to an insecure default TLS configuration. Users are strongly advised to update their packages to the latest versions to mitigate potential risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for libhttp-tiny-perl →
FAQ
The vulnerability can lead to man-in-the-middle attacks, where an attacker could intercept and manipulate HTTP traffic, potentially exposing sensitive information.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file, such as package-lock.json, to check for vulnerabilities.
While updating the package is the recommended solution, you can temporarily enable certificate verification in your HTTP::Tiny configurations as a workaround.
The affected versions are libhttp-tiny-perl before 0.083 and perl before 5.38.2-2.
More details can be found in the official Debian CVE database or by visiting the Vulert website for real-time monitoring of open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for libhttp-tiny-perl.
