CVE-2013-2145
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows...
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
Exploit likelihood
What each source reports
NVD Score used
4.4
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
- Record
CVE-2013-2145- CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
- Record
CVE-2013-2145- Updated
- 2026-11-02
EUVDEUVD-2013-2110 No score
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
- Record
EUVD-2013-2110- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-99g4-3v63-xpqx No score
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows...
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
- Record
GHSA-99g4-3v63-xpqx- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
- Record
CVE-2013-2145- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-2145 No score
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.
- Record
DEBIAN-CVE-2013-2145- Updated
- 2026-11-02
OSVMGASA-2013-0184 No score
Updated perl-Module-Signature package fixes CVE-2013-2145
Arbitrary code execution vulnerability in Module::Signature before 0.72 (CVE-2013-2145).
- Record
MGASA-2013-0184- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10458-1 No score
perl-Module-Signature-0.81-1.1 on GA media
These are all security issues fixed in the perl-Module-Signature-0.81-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10458-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libmodule-signature-perlDebian:12 |
before 0.73-1 | 0.73-1 |
libmodule-signature-perlDebian:13 |
before 0.73-1 | 0.73-1 |
libmodule-signature-perlDebian:14 |
before 0.73-1 | 0.73-1 |
perl-Module-SignatureMageia:2 |
before 0.730.0-1.mga2 | 0.730.0-1.mga2 |
perl-Module-SignatureMageia:3 |
before 0.730.0-1.mga3 | 0.730.0-1.mga3 |
perl-Module-SignatureopenSUSE:Tumbleweed |
before 0.81-1.1 | 0.81-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-2145 is a medium vulnerability (CVSS 4.4) in Canonical Ubuntu Linux, published June 26, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in libmodule-signature-perl 0.73-1.
References
lists.opensuse.org/opensuse-updates/2013-07/msg00043.html
securityfocus.com/bid/60352
lists.opensuse.org/opensuse-updates/2013-07/msg00039.html
openwall.com/lists/oss-security/2013/06/05/16
ubuntu.com/usn/USN-1896-1
github.com/audreyt/module-signature/commit/cbd06b392a73c63159dc5c20ff5b3c8fc88c4896
Show 13 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=971096
github.com/audreyt/module-signature/commit/575f7bd6ba4cc7c92f841e8758f88a131674ebf2
nvd.nist.gov/vuln/detail/CVE-2013-2145
github.com/advisories/GHSA-99g4-3v63-xpqx
security-tracker.debian.org/tracker/CVE-2013-2145
advisories.mageia.org/MGASA-2013-0184.html
lists.fedoraproject.org/pipermail/package-announce/2013-June/109387.html
bugs.mageia.org/show_bug.cgi?id=10558
suse.com/security/cve/CVE-2013-2145
suse.com/security/cve/CVE-2015-3406
suse.com/security/cve/CVE-2015-3407
suse.com/security/cve/CVE-2015-3408
suse.com/security/cve/CVE-2015-3409