Advisories » MGASA-2025-0276

Updated perl-CPAN & perl-HTTP-Tiny packages fix security vulnerabilities

Publication date: 12 Nov 2025
Modification date: 12 Nov 2025
Type: security
Affected Mageia releases : 9
CVE: CVE-2023-31484 , CVE-2023-31486

Description

CPAN.pm before 2.35 does not verify TLS certificates when downloading
distributions over HTTPS. (CVE-2023-31484)
HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available
standalone on CPAN, has an insecure default TLS configuration where
users must opt in to verify certificates. (CVE-2023-31486)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=31852
• https://www.openwall.com/lists/oss-security/2023/04/29/1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31484
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31486

SRPMS

9/core

• perl-CPAN-2.340.0-1.1.mga9
• perl-HTTP-Tiny-0.82.0-1.1.mga9