oss-sec mailing list archives
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
From: Jeffrey Walton <noloader () gmail com>
Date: Wed, 3 May 2023 15:41:26 -0400
On Wed, May 3, 2023 at 3:21 PM Reid Sutherland <reid () thirddimension net> wrote:
On 4/29/23 06:04, Stig Palmquist wrote:- CVE-2023-31484 for CPAN.pm - CVE-2023-31485 for GitLab::API::v4 - CVE-2023-31486 for HTTP::Tiny ...Who actually decides when something receives a CVE? This can be used to defame projects and products as in this case.
"Who decides" can be a tricky question. Several organizations issue CVEs, like Red Hat and Gentoo. A bug usually has to meet a criteria, like falling into a CWE category, to be issued by the organization. You can also get them from Mitre's site. In the case of Mitre, it is the person who requests the CVE. Some CVE's are tenuous or questionable. You often see this from folks trying to pad their resume. For example, a researcher may request a CVE for a behavior that requires elevated privileges. In this case, someone who is Root on Linux or Administrator on Windows can already do the damage, so the behavior in question that happens with privileges is not really interesting. In the case of HTTP::Tiny, the default configuration and behavior is running afoul of https://cwe.mitre.org/data/definitions/295.html and https://cwe.mitre.org/data/definitions/319.html. In this case, the industry believes comms should use HTTPS and the name hostname should be validated. Jeff
Current thread:
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules, (continued)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules David A. Wheeler (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Reid Sutherland (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Moritz Bechler (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Michael Orlitzky (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Reid Sutherland (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Sam Bull (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Alan Coopersmith (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Rainer Canavan (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules David A. Wheeler (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Steffen Nurpmeso (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Jeffrey Walton (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules John Helmert III (May 07)