oss-sec mailing list archives
Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules
From: John Helmert III <ajak () gentoo org>
Date: Sun, 7 May 2023 11:11:47 -0700
On Wed, May 03, 2023 at 03:41:26PM -0400, Jeffrey Walton wrote:
On Wed, May 3, 2023 at 3:21 PM Reid Sutherland <reid () thirddimension net> wrote:On 4/29/23 06:04, Stig Palmquist wrote:- CVE-2023-31484 for CPAN.pm - CVE-2023-31485 for GitLab::API::v4 - CVE-2023-31486 for HTTP::Tiny ...Who actually decides when something receives a CVE? This can be used to defame projects and products as in this case."Who decides" can be a tricky question. Several organizations issue CVEs, like Red Hat and Gentoo. A bug usually has to meet a criteria, like falling into a CWE category, to be issued by the organization.
Actually, Gentoo is NOT a CNA, and thus cannot issue CVEs.
You can also get them from Mitre's site. In the case of Mitre, it is the person who requests the CVE. Some CVE's are tenuous or questionable. You often see this from folks trying to pad their resume. For example, a researcher may request a CVE for a behavior that requires elevated privileges. In this case, someone who is Root on Linux or Administrator on Windows can already do the damage, so the behavior in question that happens with privileges is not really interesting. In the case of HTTP::Tiny, the default configuration and behavior is running afoul of https://cwe.mitre.org/data/definitions/295.html and https://cwe.mitre.org/data/definitions/319.html. In this case, the industry believes comms should use HTTPS and the name hostname should be validated. Jeff
Attachment:
signature.asc
Description:
Current thread:
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules, (continued)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Reid Sutherland (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Moritz Bechler (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Michael Orlitzky (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Reid Sutherland (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Sam Bull (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Alan Coopersmith (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Rainer Canavan (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules David A. Wheeler (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Steffen Nurpmeso (May 04)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules Jeffrey Walton (May 03)
- Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules John Helmert III (May 07)