Archive::Tar preserves permissions in the tarball; extracted file permissions will be set from users umask instead.

• https://github.com/andk/cpanpm/commit/079fa2e7ee77d626eab8bb06d0465c6a05f6c8b6
• https://rt.cpan.org/Ticket/Display.html?id=46384

The verify_SSL flag is missing from HTTP::Tiny, and allows a network attacker to MITM the connection if it is used by the CPAN client

• https://github.com/andk/cpanpm/commit/9c98370287f4e709924aee7c58ef21c85289a7f0
• https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/
• https://github.com/andk/cpanpm/pull/175
• https://www.openwall.com/lists/oss-security/2023/04/18/14

CPAN 2.28 allows Signature Verification Bypass.

• https://metacpan.org/pod/distribution/CPAN/scripts/cpan
• https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
• http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/