Red Hat Security Advisory: perl-CPAN security update
An update for perl-CPAN is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-16156US | high7.8 | — | ||
CPAN 2.28 allows Signature Verification Bypass. | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Fixedperl-CPAN-0:2.18-402.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:8432 - Fixedperl-CPAN-0:2.18-402.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2025:8432 - Workaroundperl-CPAN-0:2.18-402.el8_10.noarch as a component of Red Hat Enterprise Linux AppStream (v. 8)
This issue can be mitigated by configuring perl-CPAN to only use trusted CPAN mirrors (www.cpan.org or cpan.metacpan.org) and use HTTPS for communication with CPAN servers. If you already have a cpan configured, the list of configured mirrors can be viewed by running the `cpan` command without any argument and entering the following command on the cpan command's prompt: ``` o conf urllist ``` Ensure that the URL list only includes trusted mirrors and that https:// scheme is used for all URLs. A different set of mirrors can be configured using the following commands (these examples show how to configure one or more mirrors, only one of the commands should be used): ``` o conf urllist https://www.cpan.org o conf urllist https://www.cpan.org https://cpan.metacpan.org ``` After changing configuration, the following command must be used to save the configuration: ``` o conf commit ```
- Workaroundperl-CPAN-0:2.18-402.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
This issue can be mitigated by configuring perl-CPAN to only use trusted CPAN mirrors (www.cpan.org or cpan.metacpan.org) and use HTTPS for communication with CPAN servers. If you already have a cpan configured, the list of configured mirrors can be viewed by running the `cpan` command without any argument and entering the following command on the cpan command's prompt: ``` o conf urllist ``` Ensure that the URL list only includes trusted mirrors and that https:// scheme is used for all URLs. A different set of mirrors can be configured using the following commands (these examples show how to configure one or more mirrors, only one of the commands should be used): ``` o conf urllist https://www.cpan.org o conf urllist https://www.cpan.org https://cpan.metacpan.org ``` After changing configuration, the following command must be used to save the configuration: ``` o conf commit ```
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan