Vulnerability · Published Aug 27, 2024 · Assigned by mitre
CVE-2024-45321
Critical 9.8
In plain English
A critical-severity security flaw in the perl-App-cpanminus package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.7%top 45.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | perl-App-cpanminus | 1.7044-6.module_el8.10.0+3924+8d272be4 | ALSA-2024:10219 |
| AlmaLinux:9 | perl-App-cpanminus | 1.7044-14.1.el9_5 | ALSA-2024:10218 |
| AlmaLinux:8 | perl-CPAN-DistnameInfo | 0.12-13.module_el8.6.0+2810+886f1911 | ALSA-2024:10219 |
| AlmaLinux:8 | perl-CPAN-Meta-Check | 0.014-6.module_el8.10.0+3924+8d272be4 | ALSA-2024:10219 |
| AlmaLinux:8 | perl-File-pushd | 1.014-6.module_el8.6.0+2851+b32f1bac | ALSA-2024:10219 |
| AlmaLinux:8 | perl-Module-CPANfile | 1.1002-7.module_el8.6.0+2792+592c5e39 | ALSA-2024:10219 |
| AlmaLinux:8 | perl-Parse-PMFile | 0.41-7.module_el8.6.0+2851+b32f1bac | ALSA-2024:10219 |
| AlmaLinux:8 | perl-String-ShellQuote | 1.04-24.module_el8.6.0+2810+886f1911 | ALSA-2024:10219 |
| Debian:12 | cpanminus | no fix listed | DEBIAN-CVE-2024-45321 |
| Debian:13 | cpanminus | no fix listed | DEBIAN-CVE-2024-45321 |
| Debian:14 | cpanminus | no fix listed | DEBIAN-CVE-2024-45321 |
| Rocky Linux:8 | perl-App-cpanminus | 0:1.7044-6.module+el8.10.0+1886+95a09097 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-App-cpanminus | 0:1.7044-6.module+el8.10.0+1886+1e729698 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-App-cpanminus | 0:1.7044-6.module+el8.10.0+1886+c31d99b8 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-App-cpanminus | 0:1.7044-6.module+el8.10.0+1886+1635aa55 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.10.0+1890+318cbfb5 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.6.0+878+f93dfff7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.9.0+1491+219f8fe7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.9.0+1491+3507a112 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.9.0+1491+a1bcd037 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.10.0+1616+0d20cc68 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.10.0+1890+1072d5cf | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-DistnameInfo | 0:0.12-13.module+el8.10.0+1890+281b551b | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.9.0+1491+19eb7ac4 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.9.0+1491+219f8fe7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.9.0+1491+3507a112 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.9.0+1491+a1bcd037 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.10.0+1890+281b551b | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.10.0+1890+1072d5cf | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.10.0+1890+318cbfb5 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-CPAN-Meta-Check | 0:0.014-6.module+el8.10.0+1890+372c0e22 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.10.0+1890+372c0e22 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.10.0+1890+1072d5cf | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.9.0+1491+219f8fe7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.9.0+1491+3507a112 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.10.0+1890+281b551b | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.9.0+1491+a1bcd037 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.10.0+1890+318cbfb5 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-File-pushd | 0:1.014-6.module+el8.9.0+1491+19eb7ac4 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.10.0+1890+372c0e22 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.9.0+1491+19eb7ac4 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.10.0+1890+281b551b | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.9.0+1491+219f8fe7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.10.0+1890+1072d5cf | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.9.0+1491+a1bcd037 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.9.0+1491+3507a112 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Module-CPANfile | 0:1.1002-7.module+el8.10.0+1890+318cbfb5 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.9.0+1491+3507a112 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.9.0+1491+a1bcd037 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.10.0+1890+1072d5cf | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.9.0+1491+19eb7ac4 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.9.0+1491+219f8fe7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.10.0+1890+281b551b | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.10.0+1890+318cbfb5 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-Parse-PMFile | 0:0.41-7.module+el8.10.0+1890+372c0e22 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.10.0+1890+281b551b | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.10.0+1890+1072d5cf | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.10.0+1890+318cbfb5 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.10.0+1890+372c0e22 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.9.0+1491+19eb7ac4 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.9.0+1491+219f8fe7 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.9.0+1491+3507a112 | RLSA-2024:10219 |
| Rocky Linux:8 | perl-String-ShellQuote | 0:1.04-24.module+el8.9.0+1491+a1bcd037 | RLSA-2024:10219 |
| Ubuntu:22.04:LTS | cpanminus | no fix listed | UBUNTU-CVE-2024-45321 |
| Ubuntu:24.04:LTS | cpanminus | no fix listed | UBUNTU-CVE-2024-45321 |
| Ubuntu:25.10 | cpanminus | no fix listed | UBUNTU-CVE-2024-45321 |
| Ubuntu:26.04:LTS | cpanminus | no fix listed | UBUNTU-CVE-2024-45321 |
| Ubuntu:26.10 | cpanminus | no fix listed | UBUNTU-CVE-2024-45321 |
Affected products (as reported)
Weakness: CWE-494 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H