CVE-2023-31484: cpanpm_project cpanpm Improper Certificate Validation
CVSS: 8.1v3.1HighModified
AliasesSUSE-SU-2023:2881-1SUSE-SU-2023:2882-1RHSA-2023:6539RHSA-2024:3094RHSA-2026:0079UBUNTU-CVE-2023-31484USN-6112-1USN-6112-2DEBIAN-CVE-2023-31484
Published 28-04-2023Last modified 03-11-2025
Vulnerability summary
CVE-2023-31484 is a high (CVSS 8.1) Improper Certificate Validation vulnerability in cpanpm_project cpanpm. EPSS estimates a 1.55% chance of exploitation in the next 30 days, higher than 74.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
8.1/10
010
High · v3.1 (CVE.org)EPSS score
1.55%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 5 · Related 1Timeline
- 28-04-2023PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
CVSS metrics
5 scores · 5 sources · 1 versionHigh 8.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSources5 sources · 7.4–8.1
- OSV · Red hatEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.55%
Chance of exploitation in the next 30 days
Percentile
75%
Versus all other CVEs
30-day change
0.00 pp
From 1.55% on 21-09-2026
21-09-202621-10-2026
EPSS score1.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCpanpm
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Suse26 products
- perl&distro=SUSE Enterprise Storage 7.1< 5.26.1-150300.17.14.1
- perl&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS< 5.26.1-150300.17.14.1
- perl&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 5.26.1-150300.17.14.1
- perl&distro=SUSE Linux Enterprise Micro 5.1< 5.26.1-150300.17.14.1
- perl&distro=SUSE Linux Enterprise Micro 5.2< 5.26.1-150300.17.14.1
Redhat19 products
- perl< 4:5.16.3-299.el7_9.1
- perl-core< 0:5.16.3-299.el7_9.1
- perl-CPAN< 0:2.18-399.el8 | < 0:2.29-3.el9 | < 0:1.9800-299.el7_9.1
- perl-debuginfo< 4:5.16.3-299.el7_9.1
- perl-devel< 4:5.16.3-299.el7_9.1
Opensuse4 products
- perl&distro=openSUSE Leap 15.4< 5.26.1-150300.17.14.1
- perl&distro=openSUSE Leap 15.5< 5.26.1-150300.17.14.1
- perl&distro=openSUSE Leap Micro 5.3< 5.26.1-150300.17.14.1
- perl&distro=openSUSE Leap Micro 5.4< 5.26.1-150300.17.14.1
Cpanpm_project1 product
- cpanpm< 2.35
Debian1 product
- perl< 5.36.0-7+deb12u3 | < 5.38.2-2
Perl1 product
- perl< 5.38.0
Ubuntu1 product
- perl< 5.18.2-2ubuntu1.7+esm5 | < 5.22.1-9ubuntu0.9+esm2 | < 5.26.1-6ubuntu0.7 | < 5.30.0-9ubuntu0.4 | < 5.34.0-3ubuntu1.2
7 vendors · 53 products
References
34 links- blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/REPORTMitigationPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2023/05/07/2Mailing List
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
