CVE-2023-31486

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

A small, simple, correct HTTP/1.1 client.

Security Fix(es):

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.(CVE-2023-31486)

A highly capable, feature-rich programming language.

Security Fix(es):

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.(CVE-2023-31486)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.(CVE-2023-31486)

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects.

Security Fix(es):

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.(CVE-2023-31486)

This is a very simple HTTP/1.1 client, designed for doing simple requests without the overhead of a large framework like LWP::UserAgent.

Security Fix(es):

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.(CVE-2023-31486)

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

HTTP::Tiny is a small and simple HTTP/1.1 client written in Perl.

Security Fix(es):

• http-tiny: insecure TLS cert default (CVE-2023-31486)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

HTTP::Tiny is a small and simple HTTP/1.1 client written in Perl.

Security Fix(es):

• http-tiny: insecure TLS cert default (CVE-2023-31486)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• SECURITY UPDATE: insecure default TLS configuration in HTTP::Tiny module
  • debian/patches/CVE-2023-31486.patch: add verify_SSL=>1 to HTTP::Tiny default configuration
  • CVE-2023-31486

• SECURITY UPDATE: insecure default TLS configuration in HTTP::Tiny module
  • debian/patches/CVE-2023-31486.patch: add verify_SSL=>1 to HTTP::Tiny default configuration
  • CVE-2023-31486

• CVE-2023-31486: add verify_SSL=>1 to HTTP::Tiny default configuration

• CVE-2023-31486: add verify_SSL=>1 to HTTP::Tiny default configuration

• CVE-2023-31484: fix possible MITM attach due to missing SSL verification
• CVE-2023-31486: add verify_SSL=>1 to HTTP::Tiny default configuration

• CVE-2023-31486: fix insecure default TLS configuration

• CVE-2023-31486: fix insecure default TLS configuration

• CVE-2023-31486: fix insecure default TLS configuration

• CVE-2023-31486: fix insecure default TLS configuration
• Enable automated tests during build

• CVE-2023-31486: add verify_SSL=>1 to HTTP::Tiny default configuration

• SECURITY UPDATE: HTTP::Tiny does not verify TLS certificates by default
  • debian/patches/CVE-2023-31486.patch: flip verify_SSL default from 0 to 1 in cpan/HTTP-Tiny/lib/HTTP/Tiny.pm; add PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT escape-hatch env var; update POD (SSL SUPPORT -> TLS/SSL SUPPORT, machine-in-the-middle, extra CA search paths); add offline regression test cpan/HTTP-Tiny/t/180_verify_SSL.t.
  • CVE-2023-31486

• CVE-2023-31486: HTTP::Tiny verifies TLS certificates by default

• CVE-2023-31486: HTTP::Tiny verifies TLS certificates by default

• CVE-2023-31486: HTTP::Tiny verifies TLS certificates by default

• CVE-2023-31486: fix insecure default TLS configuration
• Enable automated tests during build

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. (CVE-2023-31484) HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. (CVE-2023-31486)

This update for perl-HTTP-Tiny fixes the following issues:

perl-HTTP-Tiny was updated to 0.086:

see /usr/share/doc/packages/perl-HTTP-Tiny/Changes

0.086 2023-06-22 10:06:37-04:00 America/New_York

- Fix code to use `$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}` as documented.

0.084 2023-06-14 06:35:01-04:00 America/New_York

- No changes from 0.083-TRIAL.

0.083 2023-06-11 07:05:45-04:00 America/New_York (TRIAL RELEASE)

[!!! SECURITY !!!]
- Changes the `verify_SSL` default parameter from `0` to `1`.
  Fixes CVE-2023-31486 (boo#1211002)
- `$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}` can be used to restore the
  old default if required.

0.081 2022-07-17 09:01:51-04:00 America/New_York (TRIAL RELEASE)

  [FIXED]
  - No longer deletes the 'headers' key from post_form arguments hashref.
  [DOCS]
  - Noted that request/response content are handled as raw bytes.

0.079 2021-11-04 12:33:43-04:00 America/New_York (TRIAL RELEASE)

  [FIXED]
  - Fixed uninitialized value warnings on older Perls when the REQUEST_METHOD
    environment variable is set and CGI_HTTP_PROXY is not.

0.077 2021-07-22 13:07:14-04:00 America/New_York (TRIAL RELEASE)

  [ADDED]

  - Added a `patch` helper method for the HTTP `PATCH` verb.
  - If the REQUEST_METHOD environment variable is set, then CGI_HTTP_PROXY
    replaces HTTP_PROXY.

  [FIXED]

  - Unsupported scheme errors early without giving an uninitialized value
    warning first.
  - Sends Content-Length: 0 on empty body PUT/POST.  This is not in the spec,
    but some servers require this.
  - Allows optional status line reason, as clarified in RFC 7230.
  - Ignore SIGPIPE on reads as well as writes, as IO::Socket::SSL says that
    SSL reads can also send writes as a side effect.
  - Check if a server has closed a connection before preserving it for reuse.

  [DOCS]

  - Clarified that exceptions/errors result in 599 status codes.

  [PREREQS]

  - Optional IO::Socket::IP prereq must be at least version 0.32 to be used.
    This ensures correct timeout support.

0.076 2018-08-05 21:07:38-04:00 America/New_York

  - No changes from 0.075-TRIAL.

0.075 2018-08-01 07:03:36-04:00 America/New_York (TRIAL RELEASE)

  [CHANGED] - The 'peer' option now also can take a code reference

0.073 2018-07-24 11:33:53-04:00 America/New_York (TRIAL RELEASE)

  [DOCS] - Documented 'protocol' field in response hash.

0.071 2018-04-22 14:45:43+02:00 Europe/Oslo (TRIAL RELEASE)

  [DOCS] - Documented that method argument to request() is case-sensitive.

This update for perl-HTTP-Tiny fixes the following issues:

perl-HTTP-Tiny was updated to 0.086:

see /usr/share/doc/packages/perl-HTTP-Tiny/Changes

0.086 2023-06-22 10:06:37-04:00 America/New_York

- Fix code to use `$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}` as documented.

0.084 2023-06-14 06:35:01-04:00 America/New_York

- No changes from 0.083-TRIAL.

0.083 2023-06-11 07:05:45-04:00 America/New_York (TRIAL RELEASE)

[!!! SECURITY !!!]
- Changes the `verify_SSL` default parameter from `0` to `1`.
  Fixes CVE-2023-31486 (boo#1211002)
- `$ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT}` can be used to restore the
  old default if required.

0.081 2022-07-17 09:01:51-04:00 America/New_York (TRIAL RELEASE)

  [FIXED]
  - No longer deletes the 'headers' key from post_form arguments hashref.
  [DOCS]
  - Noted that request/response content are handled as raw bytes.

0.079 2021-11-04 12:33:43-04:00 America/New_York (TRIAL RELEASE)

  [FIXED]
  - Fixed uninitialized value warnings on older Perls when the REQUEST_METHOD
    environment variable is set and CGI_HTTP_PROXY is not.

0.077 2021-07-22 13:07:14-04:00 America/New_York (TRIAL RELEASE)

  [ADDED]

  - Added a `patch` helper method for the HTTP `PATCH` verb.
  - If the REQUEST_METHOD environment variable is set, then CGI_HTTP_PROXY
    replaces HTTP_PROXY.

  [FIXED]

  - Unsupported scheme errors early without giving an uninitialized value
    warning first.
  - Sends Content-Length: 0 on empty body PUT/POST.  This is not in the spec,
    but some servers require this.
  - Allows optional status line reason, as clarified in RFC 7230.
  - Ignore SIGPIPE on reads as well as writes, as IO::Socket::SSL says that
    SSL reads can also send writes as a side effect.
  - Check if a server has closed a connection before preserving it for reuse.

  [DOCS]

  - Clarified that exceptions/errors result in 599 status codes.

  [PREREQS]

  - Optional IO::Socket::IP prereq must be at least version 0.32 to be used.
    This ensures correct timeout support.

0.076 2018-08-05 21:07:38-04:00 America/New_York

  - No changes from 0.075-TRIAL.

0.075 2018-08-01 07:03:36-04:00 America/New_York (TRIAL RELEASE)

  [CHANGED] - The 'peer' option now also can take a code reference

0.073 2018-07-24 11:33:53-04:00 America/New_York (TRIAL RELEASE)

  [DOCS] - Documented 'protocol' field in response hash.

0.071 2018-04-22 14:45:43+02:00 Europe/Oslo (TRIAL RELEASE)

  [DOCS] - Documented that method argument to request() is case-sensitive.

These are all security issues fixed in the perl-HTTP-Tiny-0.086-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2023-31486 in the perl package for Root:Debian:12. Multiple fixed versions available.