CVE-2024-45321
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling...
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
CVE-2024-45321- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
CVE List
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
CVE-2024-45321- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-494
- Updated
- 2026-11-02
EUVDEUVD-2024-41438
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
EUVD-2024-41438- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9mmm-86g7-vp9g
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling...
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
GHSA-9mmm-86g7-vp9g- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-94, CWE-494
- Updated
- 2026-11-02
OSV
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
CVE-2024-45321- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-45321
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
DEBIAN-CVE-2024-45321- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVRHSA-2024:10218
Red Hat Security Advisory: perl-App-cpanminus security update
- Record
RHSA-2024:10218- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2024:10219
Moderate: perl-App-cpanminus:1.7044 security update
The panminus is a script to get, unpack, build and install modules from CPAN.
Security Fix(es):
- perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2024:10219- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-45321
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.
- Record
UBUNTU-CVE-2024-45321- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVALSA-2024:10218 No score
Moderate: perl-App-cpanminus security update
Why? It's dependency free, requires zero configuration, and stands alone but it's maintainable and extensible with plug-ins and friendly to shell scripting. When running, it requires only 10 MB of RAM.
Security Fix(es):
- perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:10218- Updated
- 2026-11-02
OSVALSA-2024:10219 No score
Moderate: perl-App-cpanminus:1.7044 security update
The panminus is a script to get, unpack, build and install modules from CPAN.
Security Fix(es):
- perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:10219- Updated
- 2026-11-02
OSVCLSA-2025-1762957887 No score
perl-App-cpanminus: Fix of CVE-2024-45321
- CVE-2024-45321: patch the code to use https instead of http
- Record
CLSA-2025-1762957887- Updated
- 2026-11-02
OSVMGASA-2024-0339 No score
Updated cpanminus packages fix security vulnerability
The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers. (CVE-2024-45321)
- Record
MGASA-2024-0339- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14291-1 No score
perl-App-cpanminus-1.7047-2.1 on GA media
These are all security issues fixed in the perl-App-cpanminus-1.7047-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14291-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
perl-App-cpanminusAlmaLinux:9 |
before 1.7044-14.1.el9_5 | 1.7044-14.1.el9_5 |
perl-App-cpanminusAlmaLinux:8 |
before 1.7044-6.module_el8.10.0+3924+8d272be4 | 1.7044-6.module_el8.10.0+3924+8d272be4 |
perl-CPAN-DistnameInfoAlmaLinux:8 |
before 0.12-13.module_el8.6.0+2810+886f1911 | 0.12-13.module_el8.6.0+2810+886f1911 |
perl-CPAN-Meta-CheckAlmaLinux:8 |
before 0.014-6.module_el8.10.0+3924+8d272be4 | 0.014-6.module_el8.10.0+3924+8d272be4 |
perl-File-pushdAlmaLinux:8 |
before 1.014-6.module_el8.6.0+2851+b32f1bac | 1.014-6.module_el8.6.0+2851+b32f1bac |
perl-Module-CPANfileAlmaLinux:8 |
before 1.1002-7.module_el8.6.0+2792+592c5e39 | 1.1002-7.module_el8.6.0+2792+592c5e39 |
perl-Parse-PMFileAlmaLinux:8 |
before 0.41-7.module_el8.6.0+2851+b32f1bac | 0.41-7.module_el8.6.0+2851+b32f1bac |
perl-String-ShellQuoteAlmaLinux:8 |
before 1.04-24.module_el8.6.0+2810+886f1911 | 1.04-24.module_el8.6.0+2810+886f1911 |
perl-App-cpanminusTuxCare:AlmaLinux:9.2 |
before 1.7044-14.el9.tuxcare.els1 | 1.7044-14.el9.tuxcare.els1 |
perl-App-cpanminus-testsTuxCare:AlmaLinux:9.2 |
before 1.7044-14.el9.tuxcare.els1 | 1.7044-14.el9.tuxcare.els1 |
Show 66 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cpanminusDebian:12 |
All versions, plus listed versions 1.7046-11.7047-11.7048-11.7049-1 |
None known |
cpanminusDebian:13 |
All versions, plus listed versions 1.7048-11.7049-1 |
None known |
cpanminusDebian:14 |
All versions, plus listed versions 1.7048-11.7049-1 |
None known |
cpanminusMageia:9 |
before 1.704.500-2.1.mga9 | 1.704.500-2.1.mga9 |
perl-App-cpanminusRed Hat:enterprise_linux:9::appstream |
before 0:1.7044-14.1.el9_5 | 0:1.7044-14.1.el9_5 |
perl-App-cpanminusRocky Linux:8 |
before 0:1.7044-6.module+el8.10.0+1886+1635aa55 | 0:1.7044-6.module+el8.10.0+1886+1635aa55 |
perl-App-cpanminusRocky Linux:8 |
before 0:1.7044-6.module+el8.10.0+1886+c31d99b8 | 0:1.7044-6.module+el8.10.0+1886+c31d99b8 |
perl-App-cpanminusRocky Linux:8 |
before 0:1.7044-6.module+el8.10.0+1886+1e729698 | 0:1.7044-6.module+el8.10.0+1886+1e729698 |
perl-App-cpanminusRocky Linux:8 |
before 0:1.7044-6.module+el8.10.0+1886+95a09097 | 0:1.7044-6.module+el8.10.0+1886+95a09097 |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.10.0+1616+0d20cc68 | 0:0.12-13.module+el8.10.0+1616+0d20cc68 |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.10.0+1890+1072d5cf | 0:0.12-13.module+el8.10.0+1890+1072d5cf |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.10.0+1890+281b551b | 0:0.12-13.module+el8.10.0+1890+281b551b |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.10.0+1890+318cbfb5 | 0:0.12-13.module+el8.10.0+1890+318cbfb5 |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.6.0+878+f93dfff7 | 0:0.12-13.module+el8.6.0+878+f93dfff7 |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.9.0+1491+219f8fe7 | 0:0.12-13.module+el8.9.0+1491+219f8fe7 |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.9.0+1491+3507a112 | 0:0.12-13.module+el8.9.0+1491+3507a112 |
perl-CPAN-DistnameInfoRocky Linux:8 |
before 0:0.12-13.module+el8.9.0+1491+a1bcd037 | 0:0.12-13.module+el8.9.0+1491+a1bcd037 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.10.0+1890+1072d5cf | 0:0.014-6.module+el8.10.0+1890+1072d5cf |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.10.0+1890+318cbfb5 | 0:0.014-6.module+el8.10.0+1890+318cbfb5 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.10.0+1890+372c0e22 | 0:0.014-6.module+el8.10.0+1890+372c0e22 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.9.0+1491+19eb7ac4 | 0:0.014-6.module+el8.9.0+1491+19eb7ac4 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.9.0+1491+219f8fe7 | 0:0.014-6.module+el8.9.0+1491+219f8fe7 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.9.0+1491+3507a112 | 0:0.014-6.module+el8.9.0+1491+3507a112 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.9.0+1491+a1bcd037 | 0:0.014-6.module+el8.9.0+1491+a1bcd037 |
perl-CPAN-Meta-CheckRocky Linux:8 |
before 0:0.014-6.module+el8.10.0+1890+281b551b | 0:0.014-6.module+el8.10.0+1890+281b551b |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.10.0+1890+1072d5cf | 0:1.014-6.module+el8.10.0+1890+1072d5cf |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.9.0+1491+219f8fe7 | 0:1.014-6.module+el8.9.0+1491+219f8fe7 |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.9.0+1491+3507a112 | 0:1.014-6.module+el8.9.0+1491+3507a112 |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.10.0+1890+281b551b | 0:1.014-6.module+el8.10.0+1890+281b551b |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.9.0+1491+a1bcd037 | 0:1.014-6.module+el8.9.0+1491+a1bcd037 |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.10.0+1890+318cbfb5 | 0:1.014-6.module+el8.10.0+1890+318cbfb5 |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.10.0+1890+372c0e22 | 0:1.014-6.module+el8.10.0+1890+372c0e22 |
perl-File-pushdRocky Linux:8 |
before 0:1.014-6.module+el8.9.0+1491+19eb7ac4 | 0:1.014-6.module+el8.9.0+1491+19eb7ac4 |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.10.0+1890+1072d5cf | 0:1.1002-7.module+el8.10.0+1890+1072d5cf |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.9.0+1491+219f8fe7 | 0:1.1002-7.module+el8.9.0+1491+219f8fe7 |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.10.0+1890+281b551b | 0:1.1002-7.module+el8.10.0+1890+281b551b |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.9.0+1491+3507a112 | 0:1.1002-7.module+el8.9.0+1491+3507a112 |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.9.0+1491+a1bcd037 | 0:1.1002-7.module+el8.9.0+1491+a1bcd037 |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.10.0+1890+318cbfb5 | 0:1.1002-7.module+el8.10.0+1890+318cbfb5 |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.10.0+1890+372c0e22 | 0:1.1002-7.module+el8.10.0+1890+372c0e22 |
perl-Module-CPANfileRocky Linux:8 |
before 0:1.1002-7.module+el8.9.0+1491+19eb7ac4 | 0:1.1002-7.module+el8.9.0+1491+19eb7ac4 |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.10.0+1890+1072d5cf | 0:0.41-7.module+el8.10.0+1890+1072d5cf |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.9.0+1491+19eb7ac4 | 0:0.41-7.module+el8.9.0+1491+19eb7ac4 |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.9.0+1491+219f8fe7 | 0:0.41-7.module+el8.9.0+1491+219f8fe7 |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.9.0+1491+3507a112 | 0:0.41-7.module+el8.9.0+1491+3507a112 |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.9.0+1491+a1bcd037 | 0:0.41-7.module+el8.9.0+1491+a1bcd037 |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.10.0+1890+281b551b | 0:0.41-7.module+el8.10.0+1890+281b551b |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.10.0+1890+318cbfb5 | 0:0.41-7.module+el8.10.0+1890+318cbfb5 |
perl-Parse-PMFileRocky Linux:8 |
before 0:0.41-7.module+el8.10.0+1890+372c0e22 | 0:0.41-7.module+el8.10.0+1890+372c0e22 |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.10.0+1890+1072d5cf | 0:1.04-24.module+el8.10.0+1890+1072d5cf |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.10.0+1890+281b551b | 0:1.04-24.module+el8.10.0+1890+281b551b |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.10.0+1890+318cbfb5 | 0:1.04-24.module+el8.10.0+1890+318cbfb5 |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.10.0+1890+372c0e22 | 0:1.04-24.module+el8.10.0+1890+372c0e22 |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.9.0+1491+19eb7ac4 | 0:1.04-24.module+el8.9.0+1491+19eb7ac4 |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.9.0+1491+219f8fe7 | 0:1.04-24.module+el8.9.0+1491+219f8fe7 |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.9.0+1491+3507a112 | 0:1.04-24.module+el8.9.0+1491+3507a112 |
perl-String-ShellQuoteRocky Linux:8 |
before 0:1.04-24.module+el8.9.0+1491+a1bcd037 | 0:1.04-24.module+el8.9.0+1491+a1bcd037 |
cpanminusUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.7014-11.7039-11.7040-11.7040-1ubuntu0.1~esm1 |
None known |
cpanminusUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.7042-21.7043-11.7043-1ubuntu0.1~esm1 |
None known |
cpanminusUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.7044-11.7044-1ubuntu0.1~esm1 |
None known |
cpanminusUbuntu:22.04:LTS |
All versions, plus listed versions 1.7044-21.7045-1 |
None known |
cpanminusUbuntu:24.04:LTS |
All versions, plus listed versions 1.7047-1 |
None known |
cpanminusUbuntu:25.10 |
All versions, plus listed versions 1.7048-1 |
None known |
cpanminusUbuntu:26.10 |
All versions, plus listed versions 1.7048-1build11.7049-1 |
None known |
cpanminusUbuntu:26.04:LTS |
All versions, plus listed versions 1.7048-11.7048-1build1 |
None known |
perl-App-cpanminusopenSUSE:Tumbleweed |
before 1.7047-2.1 | 1.7047-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-45321 is a high vulnerability (CVSS 8.1) in Perl Cpanminus, published August 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.74%, the 54th percentile. Fixed in perl-App-cpanminus 1.7044-14.1.el9_5.
References
security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html
github.com/miyagawa/cpanminus/issues/611
nvd.nist.gov/vuln/detail/CVE-2024-45321
access.redhat.com/errata/RHSA-2024:10218
Show 18 moreShow less
bugzilla.redhat.com/2308078
errata.almalinux.org/9/ALSA-2024-10218.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762957887.html
security-tracker.debian.org/tracker/CVE-2024-45321
advisories.mageia.org/MGASA-2024-0339.html
bugs.mageia.org/show_bug.cgi?id=33631
lists.fedoraproject.org/archives/list/[email protected]/message/X5W36RUTOUQ2VUGWG2FCEBOWNRYS6RBI
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10218.json
cve.org/CVERecord?id=CVE-2024-45321
errata.rockylinux.org/RLSA-2024:10219
ubuntu.com/security/CVE-2024-45321
suse.com/security/cve/CVE-2024-45321