Vulnerability · Published Dec 13, 2021 · Assigned by mitre
CVE-2020-16156
High 7.8
In plain English
A high-severity security flaw in the perl-CPAN package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)0.9%top 41.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
CPAN 2.28 allows Signature Verification Bypass.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | perl-CPAN | 2.18-402.el8_10 | ALSA-2025:8432 |
| Debian:12 | perl | 5.36.0-4 | DEBIAN-CVE-2020-16156 |
| Debian:13 | perl | 5.36.0-4 | DEBIAN-CVE-2020-16156 |
| Debian:14 | perl | 5.36.0-4 | DEBIAN-CVE-2020-16156 |
| Rocky Linux:8 | perl-CPAN | 0:2.18-402.el8_10 | RLSA-2025:8432 |
| Ubuntu:22.04:LTS | perl | 5.34.0-3ubuntu1.1 | USN-5689-1 |
| Ubuntu:22.04:LTS | perl | 5.34.0-3ubuntu1.1 | UBUNTU-CVE-2020-16156 |
Affected products (as reported)
References
- https://metacpan.org/pod/distribution/CPAN/scripts/cpan x_refsource_MISC
- https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/ x_refsource_MISC
- http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html x_refsource_MISC
- FEDORA-2022-21e8372c42 vendor-advisory, x_refsource_FEDORA
- FEDORA-2022-84fd87f7eb vendor-advisory, x_refsource_FEDORA
- https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html