CVE-2023-31486

Published: Apr 28, 2023

Modified: Jan 30, 2025

PUBLISHED

Description

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/

https://www.openwall.com/lists/oss-security/2023/04/18/14

https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/

https://hackeriet.github.io/cpan-http-tiny-overview/

[oss-security] 20230429 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules

mailing-list

[oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules

mailing-list

[oss-security] 20230503 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules

mailing-list

https://www.openwall.com/lists/oss-security/2023/05/03/4

[oss-security] 20230507 Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules

mailing-list

https://github.com/chansen/p5-http-tiny/pull/153

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2023-31486

Description

Affected Products

References