#VU68606 Improper Verification of Cryptographic Signature in CPAN - CVE-2020-16156

Vulnerability identifier: #VU68606

Vulnerability risk: High

CVSSv4.0: 7.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2020-16156

CWE-ID: CWE-347

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
CPAN
Universal components / Libraries / Programming Languages & Components

Vendor: CPAN

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to incorrect processing of signed code. A remote attacker trick the victim into downloading a malicious file, bypass signature verification procedure and compromise the affected system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

CPAN: 2.28

---

External links
https://metacpan.org/pod/distribution/CPAN/scripts/cpan
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
https://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.