Skip to main content
Version: latest

CVE-2023-31486

CVE Details​

Visit the official vulnerability details page for CVE-2023-31486 to learn more.

Initial Publication​

10/25/2024

Last Update​

12/16/2024

Third Party Dependency​

perl-base

NIST CVE Summary​

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates.

CVE Severity​

8.1

Our Official Summary​

A vulnerability was found in Tiny, where a Perl core module and standalone CPAN package, does not verify TLS certificates by default. Users need to explicitly enable certificate verification with the verify_SSL=>1 flag to ensure secure HTTPS connections. This oversight can potentially expose applications to man-in-the-middle (MITM) attacks, where an attacker might intercept and manipulate data transmitted between the client and server.

This vulnerability does not compromise data or credentials. The third party images where this vulnerability is reported do not expose HTTP end points. In order to exploit this vulnerability, an attacker needs to get privileges access to this container and execute code which the container have controls in place to prevent. Impact of exploitation is also low, since any denial of service will be restricted to the container function.

Status​

Ongoing

Affected Products & Versions​

VersionPalette EnterprisePalette Enterprise AirgapVerteXVerteX Airgap
4.5.15⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact
4.5.11⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact
4.5.10⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact
4.5.8⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact
4.5.5⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact
4.5.4⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact
4.4.20⚠️ Impacted✅ No Impact⚠️ Impacted✅ No Impact

Revision History​

DateRevision
12/16/2024Impacted versions changed from 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10, 4.5.11 to 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10, 4.5.11, 4.5.15
12/02/2024Official summary revised: A vulnerability was found in Tiny, where a Perl core module and standalone CPAN package, does not verify TLS certificates by default. Users need to explicitly enable certificate verification with the verify_SSL=>1 flag to ensure secure HTTPS connections. This oversight can potentially expose applications to man-in-the-middle (MITM) attacks, where an attacker might intercept and manipulate data transmitted between the client and server.This vulnerability does not compromise data or credentials. The third party images where this vulnerability is reported do not expose HTTP end points. In order to exploit this vulnerability, an attacker needs to get privileges access to this container and execute code which the container have controls in place to prevent. Impact of exploitation is also low, since any denial of service will be restricted to the container function.
11/15/2024Impacted versions changed from 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10 to 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10, 4.5.11
11/15/2024Impacted versions changed from 4.5.4, 4.5.5, 4.5.8, 4.4.20 to 4.5.4, 4.5.5, 4.5.8, 4.4.20, 4.5.10
11/13/2024Impacted versions changed from 4.5.4, 4.5.5, 4.5.8 to 4.5.4, 4.5.5, 4.5.8, 4.4.20
11/10/2024Impacted versions changed from 4.5.4, 4.5.5 to 4.5.4, 4.5.5, 4.5.8
10/27/2024Impacted versions changed from 4.5.4 to 4.5.4, 4.5.5