{"id":"CVE-2024-45321","aliases":["ALSA-2024:10218","ALSA-2024:10219","CLSA-2025-1762957887","DEBIAN-CVE-2024-45321","EUVD-2024-41438","GHSA-9mmm-86g7-vp9g","MGASA-2024-0339","RHSA-2024:10218","RLSA-2024:10219","UBUNTU-CVE-2024-45321","openSUSE-SU-2024:14291-1"],"status":"published","title":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling...","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00737,"percentile":0.54789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-494","CWE-94"],"published":"2024-08-27T00:00:00Z","modified":"2026-11-02T12:02:49Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"perl-App-cpanminus","fixed_in":["1.7044-14.1.el9_5"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-App-cpanminus","fixed_in":["1.7044-6.module_el8.10.0+3924+8d272be4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-CPAN-DistnameInfo","fixed_in":["0.12-13.module_el8.6.0+2810+886f1911"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-CPAN-Meta-Check","fixed_in":["0.014-6.module_el8.10.0+3924+8d272be4"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-File-pushd","fixed_in":["1.014-6.module_el8.6.0+2851+b32f1bac"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-Module-CPANfile","fixed_in":["1.1002-7.module_el8.6.0+2792+592c5e39"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-Parse-PMFile","fixed_in":["0.41-7.module_el8.6.0+2851+b32f1bac"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"perl-String-ShellQuote","fixed_in":["1.04-24.module_el8.6.0+2810+886f1911"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-App-cpanminus","fixed_in":["1.7044-14.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-App-cpanminus-tests","fixed_in":["1.7044-14.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"cpanminus","fixed_in":["1.704.500-2.1.mga9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-App-cpanminus","fixed_in":["0:1.7044-14.1.el9_5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-App-cpanminus","fixed_in":["0:1.7044-6.module+el8.10.0+1886+1635aa55","0:1.7044-6.module+el8.10.0+1886+c31d99b8","0:1.7044-6.module+el8.10.0+1886+1e729698","0:1.7044-6.module+el8.10.0+1886+95a09097"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","fixed_in":["0:0.12-13.module+el8.10.0+1616+0d20cc68","0:0.12-13.module+el8.10.0+1890+1072d5cf","0:0.12-13.module+el8.10.0+1890+281b551b","0:0.12-13.module+el8.10.0+1890+318cbfb5","0:0.12-13.module+el8.6.0+878+f93dfff7","0:0.12-13.module+el8.9.0+1491+219f8fe7","0:0.12-13.module+el8.9.0+1491+3507a112","0:0.12-13.module+el8.9.0+1491+a1bcd037"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","fixed_in":["0:0.014-6.module+el8.10.0+1890+1072d5cf","0:0.014-6.module+el8.10.0+1890+318cbfb5","0:0.014-6.module+el8.10.0+1890+372c0e22","0:0.014-6.module+el8.9.0+1491+19eb7ac4","0:0.014-6.module+el8.9.0+1491+219f8fe7","0:0.014-6.module+el8.9.0+1491+3507a112","0:0.014-6.module+el8.9.0+1491+a1bcd037","0:0.014-6.module+el8.10.0+1890+281b551b"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-File-pushd","fixed_in":["0:1.014-6.module+el8.10.0+1890+1072d5cf","0:1.014-6.module+el8.9.0+1491+219f8fe7","0:1.014-6.module+el8.9.0+1491+3507a112","0:1.014-6.module+el8.10.0+1890+281b551b","0:1.014-6.module+el8.9.0+1491+a1bcd037","0:1.014-6.module+el8.10.0+1890+318cbfb5","0:1.014-6.module+el8.10.0+1890+372c0e22","0:1.014-6.module+el8.9.0+1491+19eb7ac4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","fixed_in":["0:1.1002-7.module+el8.10.0+1890+1072d5cf","0:1.1002-7.module+el8.9.0+1491+219f8fe7","0:1.1002-7.module+el8.10.0+1890+281b551b","0:1.1002-7.module+el8.9.0+1491+3507a112","0:1.1002-7.module+el8.9.0+1491+a1bcd037","0:1.1002-7.module+el8.10.0+1890+318cbfb5","0:1.1002-7.module+el8.10.0+1890+372c0e22","0:1.1002-7.module+el8.9.0+1491+19eb7ac4"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","fixed_in":["0:0.41-7.module+el8.10.0+1890+1072d5cf","0:0.41-7.module+el8.9.0+1491+19eb7ac4","0:0.41-7.module+el8.9.0+1491+219f8fe7","0:0.41-7.module+el8.9.0+1491+3507a112","0:0.41-7.module+el8.9.0+1491+a1bcd037","0:0.41-7.module+el8.10.0+1890+281b551b","0:0.41-7.module+el8.10.0+1890+318cbfb5","0:0.41-7.module+el8.10.0+1890+372c0e22"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","fixed_in":["0:1.04-24.module+el8.10.0+1890+1072d5cf","0:1.04-24.module+el8.10.0+1890+281b551b","0:1.04-24.module+el8.10.0+1890+318cbfb5","0:1.04-24.module+el8.10.0+1890+372c0e22","0:1.04-24.module+el8.9.0+1491+19eb7ac4","0:1.04-24.module+el8.9.0+1491+219f8fe7","0:1.04-24.module+el8.9.0+1491+3507a112","0:1.04-24.module+el8.9.0+1491+a1bcd037"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"perl-App-cpanminus","fixed_in":["1.7047-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7044-14.1.el9_5"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7044-6.module_el8.10.0+3924+8d272be4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12-13.module_el8.6.0+2810+886f1911"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.014-6.module_el8.10.0+3924+8d272be4"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.014-6.module_el8.6.0+2851+b32f1bac"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1002-7.module_el8.6.0+2792+592c5e39"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.41-7.module_el8.6.0+2851+b32f1bac"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.04-24.module_el8.6.0+2810+886f1911"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7044-14.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"perl-App-cpanminus-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7044-14.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7046-1","1.7047-1","1.7048-1","1.7049-1"]},{"source":"osv","ecosystem":"Debian:13","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7048-1","1.7049-1"]},{"source":"osv","ecosystem":"Debian:14","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7048-1","1.7049-1"]},{"source":"osv","ecosystem":"Mageia:9","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.704.500-2.1.mga9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7044-14.1.el9_5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7044-6.module+el8.10.0+1886+1635aa55"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7044-6.module+el8.10.0+1886+c31d99b8"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7044-6.module+el8.10.0+1886+1e729698"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7044-6.module+el8.10.0+1886+95a09097"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.10.0+1616+0d20cc68"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.10.0+1890+1072d5cf"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.10.0+1890+281b551b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.10.0+1890+318cbfb5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.6.0+878+f93dfff7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.9.0+1491+219f8fe7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.9.0+1491+3507a112"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-DistnameInfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.12-13.module+el8.9.0+1491+a1bcd037"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.10.0+1890+1072d5cf"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.10.0+1890+318cbfb5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.10.0+1890+372c0e22"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.9.0+1491+19eb7ac4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.9.0+1491+219f8fe7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.9.0+1491+3507a112"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.9.0+1491+a1bcd037"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-CPAN-Meta-Check","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.014-6.module+el8.10.0+1890+281b551b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.10.0+1890+1072d5cf"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.9.0+1491+219f8fe7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.9.0+1491+3507a112"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.10.0+1890+281b551b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.9.0+1491+a1bcd037"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.10.0+1890+318cbfb5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.10.0+1890+372c0e22"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-File-pushd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.014-6.module+el8.9.0+1491+19eb7ac4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.10.0+1890+1072d5cf"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.9.0+1491+219f8fe7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.10.0+1890+281b551b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.9.0+1491+3507a112"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.9.0+1491+a1bcd037"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.10.0+1890+318cbfb5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.10.0+1890+372c0e22"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Module-CPANfile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1002-7.module+el8.9.0+1491+19eb7ac4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.10.0+1890+1072d5cf"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.9.0+1491+19eb7ac4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.9.0+1491+219f8fe7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.9.0+1491+3507a112"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.9.0+1491+a1bcd037"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.10.0+1890+281b551b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.10.0+1890+318cbfb5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-Parse-PMFile","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.41-7.module+el8.10.0+1890+372c0e22"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.10.0+1890+1072d5cf"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.10.0+1890+281b551b"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.10.0+1890+318cbfb5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.10.0+1890+372c0e22"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.9.0+1491+19eb7ac4"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.9.0+1491+219f8fe7"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.9.0+1491+3507a112"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"perl-String-ShellQuote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.04-24.module+el8.9.0+1491+a1bcd037"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7014-1","1.7039-1","1.7040-1","1.7040-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7042-2","1.7043-1","1.7043-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7044-1","1.7044-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7044-2","1.7045-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7047-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7048-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7048-1build1","1.7049-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7048-1","1.7048-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"perl-App-cpanminus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7047-2.1"}]}]}],"products":[{"vendor":"app\\","product":"\\"},{"vendor":"perl","product":"cpanminus"}],"references":[{"url":"https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html","tags":["Exploit","Third Party Advisory","web","article","report"]},{"url":"https://github.com/miyagawa/cpanminus/issues/611","tags":["Issue Tracking","report","article"]},{"url":"https://github.com/miyagawa/cpanminus/pull/674","tags":["Issue Tracking","Patch","fix","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-45321","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9mmm-86g7-vp9g"},{"url":"https://access.redhat.com/errata/RHSA-2024:10218","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-45321","tags":["report"]},{"url":"https://bugzilla.redhat.com/2308078","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-10218.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:10219","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-10219.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1762957887.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45321.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-45321","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0339.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33631","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5W36RUTOUQ2VUGWG2FCEBOWNRYS6RBI/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2308078","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_10218.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-45321","tags":["advisory","report"]},{"url":"https://errata.rockylinux.org/RLSA-2024:10219","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-45321","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45321","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-45321","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T00:00:00Z","modified":"2024-09-06T13:33:38.493Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:34:08.16279Z"}],"euvd":[{"id":"EUVD-2024-41438","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T00:00:00Z","modified":"2024-09-06T13:33:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T00:56:02.201955Z"}],"ghsa":[{"id":"GHSA-9mmm-86g7-vp9g","title":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling...","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T06:30:32Z","modified":"2024-09-06T15:34:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94","CWE-494"],"updated_at":"2026-11-02T14:58:11.330333Z"}],"nvd":[{"id":"CVE-2024-45321","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T04:15:09.01Z","modified":"2026-06-17T07:54:01.447Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-494"],"updated_at":"2026-11-02T14:10:21.771404Z"}],"osv":[{"id":"CVE-2024-45321","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T00:00:00Z","modified":"2026-10-28T02:30:22.966495453Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:42.790566Z"},{"id":"DEBIAN-CVE-2024-45321","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T04:15:09.01Z","modified":"2026-11-02T12:02:49.460569738Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:43.473331Z"},{"id":"RHSA-2024:10218","title":"Red Hat Security Advisory: perl-App-cpanminus security update","status":"published","published":"2024-11-26T07:51:53Z","modified":"2026-06-30T10:05:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"},{"id":"RLSA-2024:10219","title":"Moderate: perl-App-cpanminus:1.7044 security update","description":"The panminus is a script to get, unpack, build and install modules from CPAN.\n\nSecurity Fix(es):\n\n* perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-12-19T04:18:05.672002Z","modified":"2025-10-09T05:47:38.508244Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2024-45321","description":"The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.","status":"published","published":"2024-08-27T04:15:00Z","modified":"2026-10-17T12:56:39.359049461Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:02.636559Z"},{"id":"ALSA-2024:10218","title":"Moderate: perl-App-cpanminus security update","description":"Why? It's dependency free, requires zero configuration, and stands alone but it's maintainable and extensible with plug-ins and friendly to shell scripting. When running, it requires only 10 MB of RAM.  \n\nSecurity Fix(es):  \n\n  * perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-25T00:00:00Z","modified":"2026-10-29T11:31:40.127116575Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:10219","title":"Moderate: perl-App-cpanminus:1.7044 security update","description":"The panminus is a script to get, unpack, build and install modules from CPAN.  \n\nSecurity Fix(es):  \n\n  * perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability (CVE-2024-45321)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2024-11-25T00:00:00Z","modified":"2026-10-29T11:01:32.105060772Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2025-1762957887","title":"perl-App-cpanminus: Fix of CVE-2024-45321","description":"- CVE-2024-45321: patch the code to use https instead of http","status":"published","published":"2025-11-12T14:31:31Z","modified":"2026-06-01T00:31:24.594576458Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"MGASA-2024-0339","title":"Updated cpanminus packages fix security vulnerability","description":"The App::cpanminus package through 1.7047 for Perl downloads code via\ninsecure HTTP, enabling code execution for network attackers.\n(CVE-2024-45321)\n","status":"published","published":"2024-10-27T02:37:06Z","modified":"2026-04-16T04:42:34.761022762Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:14291-1","title":"perl-App-cpanminus-1.7047-2.1 on GA media","description":"These are all security issues fixed in the perl-App-cpanminus-1.7047-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-08-27T00:00:00Z","modified":"2026-02-04T03:30:30.048561Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}