{"id":"CVE-2020-16154","aliases":["ALPINE-CVE-2020-16154","DEBIAN-CVE-2020-16154","EUVD-2020-8120","GHSA-m92x-373g-xc36","MGASA-2022-0078","UBUNTU-CVE-2020-16154","USN-5230-1","openSUSE-SU-2022:0074-1","openSUSE-SU-2024:11783-1"],"status":"published","title":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00763,"percentile":0.55655,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-347"],"published":"2021-12-13T17:00:32Z","modified":"2026-11-03T06:31:25Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"perl-app-cpanminus","fixed_in":["1.7045-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cpanminus","fixed_in":["1.7045-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cpanminus","fixed_in":["1.7045-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cpanminus","fixed_in":["1.7045-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"cpanminus","fixed_in":["1.704.500-1.mga8"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpanminus","fixed_in":["1.7040-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpanminus","fixed_in":["1.7043-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpanminus","fixed_in":["1.7044-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"cpanminus","fixed_in":["1.7045-1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"perl-App-cpanminus","fixed_in":["1.7045-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"perl-App-cpanminus","fixed_in":["1.7045-bp153.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-App-cpanminus","fixed_in":["1.7045-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"perl-app-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.704.500-1.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7040-1ubuntu0.1~esm1"}]}],"versions":["1.7014-1","1.7039-1","1.7040-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7043-1ubuntu0.1~esm1"}]}],"versions":["1.7042-2","1.7043-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7044-1ubuntu0.1~esm1"}]}],"versions":["1.7044-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-1"}]}],"versions":["1.7044-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7040-1ubuntu0.1~esm1"}]}],"versions":["1.7014-1","1.7039-1","1.7040-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7043-1ubuntu0.1~esm1"}]}],"versions":["1.7042-2","1.7043-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7044-1ubuntu0.1~esm1"}]}],"versions":["1.7044-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-bp153.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7045-1.1"}]}]}],"products":[{"vendor":"app\\","product":"\\"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://metacpan.org/pod/App::cpanminus","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-16154"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/"},{"url":"https://github.com/advisories/GHSA-m92x-373g-xc36"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-16154","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-16154","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0078.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30019","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-16154","tags":["report"]},{"url":"http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5230-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-16154","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O2R4OBBVU7JBUBEWOTAIN5NEZXBGJK6O/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16154","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-16154","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:00:32Z","modified":"2024-08-04T13:37:53.768Z","updated_at":"2026-11-02T14:35:59.116379Z"}],"euvd":[{"id":"EUVD-2020-8120","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:00:32Z","modified":"2024-08-04T13:37:53Z","updated_at":"2026-11-03T03:07:29.271552Z"}],"ghsa":[{"id":"GHSA-m92x-373g-xc36","title":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2022-02-10T00:01:23Z","modified":"2023-02-01T05:07:04Z","cwes":["CWE-347"],"updated_at":"2026-11-02T14:50:28.399252Z"}],"nvd":[{"id":"CVE-2020-16154","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:15:08.103Z","modified":"2026-06-17T02:57:47.743Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-347"],"updated_at":"2026-11-02T14:06:46.101987Z"}],"osv":[{"id":"ALPINE-CVE-2020-16154","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:15:08.103Z","modified":"2026-11-03T06:31:25.705133793Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:23.800469Z"},{"id":"CVE-2020-16154","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:15:08.103Z","modified":"2026-10-24T10:31:05.118726045Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-16154","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:15:08.103Z","modified":"2026-10-26T12:01:42.005006995Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-16154","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.","status":"published","published":"2021-12-13T17:15:00Z","modified":"2026-02-04T04:05:40.104145Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"MGASA-2022-0078","title":"Updated cpanminus packages fix security vulnerability","description":"The App::cpanminus package 1.7044 for Perl allows Signature Verification\nBypass. (CVE-2020-16154)\n","status":"published","published":"2022-02-22T20:15:16Z","modified":"2026-04-16T04:43:03.780133363Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0074-1","title":"Security update for perl-App-cpanminus","description":"This update for perl-App-cpanminus fixes the following issues:\n\nupdated to 1.7045\n\nsee /usr/share/doc/packages/perl-App-cpanminus/Changes\n\nSecurity fixes:\n\n- [CVE-2020-16154] remove the functionality to verify CHECKSUMS signature\n\nupdated to 1.7044\n\nsee /usr/share/doc/packages/perl-App-cpanminus/Changes\n","status":"published","published":"2022-03-06T15:01:16Z","modified":"2026-02-04T02:37:07.676848Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11783-1","title":"perl-App-cpanminus-1.7045-1.1 on GA media","description":"These are all security issues fixed in the perl-App-cpanminus-1.7045-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:53:41.577308Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-5230-1","title":"cpanminus vulnerability","description":"It was discovered that App::cpanminus did not properly verify CHECKSUMS files.\nAn attacker could possibly use this issue to bypass signature verification,\ngaining access to sensitive data or possibly executing unauthorized code.\n","status":"published","published":"2022-01-24T13:44:44Z","modified":"2026-06-25T13:30:56.109461814Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}