CVE-2020-16154 Security feature bypass in n/a
Attackers can bypass signature verification in the App::cpanminus Perl package, potentially installing untrusted or malicious modules.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-16154?
CVE-2020-16154 is a high-severity vulnerability in Fedoraproject Fedora, published on 13 Dec 2021. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.
Weakness: CWE-347
Which versions are affected by CVE-2020-16154?
It affects 2 products.
Linux distribution packages (3)
perl-App-cpanminus SUSE:Package Hub 15 SP3 | All versions | 1.7045-bp153.2.3.1 |
perl-App-cpanminus openSUSE:Leap 15.3 | All versions | 1.7045-bp153.2.3.1 |
perl-App-cpanminus openSUSE:Tumbleweed | All versions | 1.7045-1.1 |
Products include App\ \, Fedoraproject Fedora.
How do I fix CVE-2020-16154?
Upgrade to a fixed version.
Is CVE-2020-16154 being exploited?
There is no known exploitation of CVE-2020-16154 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2020-16154, GHSA-m92x-373g-xc36, MGASA-2022-0078, UBUNTU-CVE-2020-16154, USN-5230-1, openSUSE-SU-2022:0074-1 and 1 more.