Bug 2228392 (CVE-2023-31486)

Summary:	CVE-2023-31486 http-tiny: insecure TLS cert default
Product:	[Other] Security Response	Reporter:	TEJ RATHI <trathi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acrosby, adudiak, bdettelb, caswilli, dfreiber, doconnor, drow, fjansen, hkataria, jburrell, jmitchel, jsherril, jtanner, kaycoth, kshier, luizcosta, nweather, perl-maint-list, rtillery, stcannon, teagle, vkumar, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	HTTP-Tiny 0.083-TRIAL	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in Tiny, where a Perl core module and standalone CPAN package, does not verify TLS certificates by default. Users need to explicitly enable certificate verification with the verify_SSL=>1 flag to ensure secure HTTPS connections. This oversight can potentially expose applications to man-in-the-middle (MITM) attacks, where an attacker might intercept and manipulate data transmitted between the client and server.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2228395, 2228396, 2228397, 2228398, 2228409, 2228410, 2228411, 2228412
Bug Blocks:	2192430

Description TEJ RATHI 2023-08-02 10:20:32 UTC

HTTP::Tiny v0.082, is a http client included in Perl (since v5.13.9) and also a standalone CPAN module. It does not verify TLS certificates by default requiring users to opt-in with the verify_SSL=>1 flag to verify the identity of the HTTPS server they are communicating with.

https://www.openwall.com/lists/oss-security/2023/04/18/14
https://github.com/chansen/p5-http-tiny/issues/134
https://github.com/chansen/p5-http-tiny/pull/153
https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
https://hackeriet.github.io/cpan-http-tiny-overview/
https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/
https://github.com/advisories/GHSA-g56r-phrf-6pc4

Comment 1 TEJ RATHI 2023-08-02 10:24:53 UTC

Created perl-HTTP-Tiny tracking bugs for this issue:

Affects: fedora-all [bug 2228395]


Created perl:5.32/perl-HTTP-Tiny tracking bugs for this issue:

Affects: fedora-all [bug 2228396]


Created perl:5.34/perl-HTTP-Tiny tracking bugs for this issue:

Affects: fedora-all [bug 2228397]


Created perl:5.36/perl-HTTP-Tiny tracking bugs for this issue:

Affects: fedora-all [bug 2228398]

Comment 4 errata-xmlrpc 2023-11-07 08:19:16 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2023:6542 https://access.redhat.com/errata/RHSA-2023:6542

Comment 5 errata-xmlrpc 2023-11-14 15:22:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2023:7174 https://access.redhat.com/errata/RHSA-2023:7174

Comment 7 errata-xmlrpc 2024-01-24 16:48:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Extended Update Support

Via RHSA-2024:0422 https://access.redhat.com/errata/RHSA-2024:0422

Comment 8 errata-xmlrpc 2024-01-30 13:24:20 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:0579 https://access.redhat.com/errata/RHSA-2024:0579

Comment 12 errata-xmlrpc 2024-07-09 12:52:13 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4430 https://access.redhat.com/errata/RHSA-2024:4430