Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Mageia 9: perl-CPAN & perl-HTTP-Tiny Security Updates MGASA-2025-0276

mageia
Calendar Grey November 12, 2025
Dist Mageia Esm H88
Updated perl-CPAN and perl-HTTP-Tiny address security issues with ignoring TLS certificate verification.
MGASA-2025-0276 - Updated perl-CPAN & perl-HTTP-Tiny packages fix security vulnerabilities

Summary

Description: CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. (CVE-2023-31484) HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. (CVE-2023-31486)

References

- https://bugs.mageia.org/show_bug.cgi?id=31852

- https://www.openwall.com/lists/oss-security/2023/04/29/1

- https://www.cve.org/CVERecord?id=CVE-2023-31484

- https://www.cve.org/CVERecord?id=CVE-2023-31486

Topics%20covered

Topics Covered

security advisory tls certificate Mageia CVE-2023-31486 cve-2023-31484 malicious downloads

Resolution

SRPMS

- 9/core/perl-CPAN-2.340.0-1.1.mga9

- 9/core/perl-HTTP-Tiny-0.82.0-1.1.mga9

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 12 Nov 2025
URL: https://advisories.mageia.org/MGASA-2025-0276.html
Type: security
CVE: CVE-2023-31484, CVE-2023-31486

Topics%20covered

Topics Covered

security advisory tls certificate Mageia CVE-2023-31486 cve-2023-31484 malicious downloads

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Related News

Your message here