CVE-2023-31484 in CPAN.pm
Summary
by MITRE • 04/29/2023
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 12/26/2025
The vulnerability identified as CVE-2023-31484 affects CPAN.pm versions prior to 2.35 and represents a critical security flaw in the Perl package manager's handling of secure communications. This issue specifically impacts the verification process for TLS certificates during HTTPS downloads of Perl distributions from the Comprehensive Perl Archive Network. The flaw exists within the core network security implementation of the tool that developers and system administrators rely upon for managing Perl dependencies and packages.
The technical root cause of this vulnerability lies in the improper implementation of certificate validation mechanisms within the CPAN.pm library. When downloading packages over HTTPS connections, the software fails to perform proper TLS certificate verification, effectively allowing man-in-the-middle attacks to occur without detection. This represents a classic case of insufficient certificate validation that aligns with CWE-295, which specifically addresses improper certificate validation in security protocols. The vulnerability creates an attack surface where malicious actors can intercept and potentially modify package downloads while maintaining the appearance of legitimate communications.
The operational impact of this vulnerability extends far beyond simple network security concerns, as it fundamentally compromises the integrity of the Perl package ecosystem. System administrators and developers who rely on CPAN.pm for dependency management face significant risks including supply chain attacks, where malicious code could be injected into legitimate package distributions. This vulnerability directly enables attacks that fall under the ATT&CK technique T1195.002 for Supply Chain Compromise, as it allows adversaries to manipulate package downloads without detection. The consequences can range from data theft and system compromise to complete system takeover through the installation of malicious code.
Organizations using affected versions of CPAN.pm should immediately implement mitigation strategies to protect their systems and development environments. The primary and most effective remediation involves upgrading to CPAN.pm version 2.35 or later, which includes proper TLS certificate verification. Additionally, system administrators should consider implementing network monitoring to detect unusual traffic patterns that might indicate certificate validation bypass attempts. Organizations should also review their package management processes and consider implementing additional verification mechanisms such as checksum validation of downloaded packages. The vulnerability demonstrates the critical importance of maintaining up-to-date security libraries and highlights the need for robust certificate validation practices in all network communication components, particularly those used for software distribution and dependency management.