The App::cpanminus package 1.7044 for Perl allows Signature Verification Bypass.

• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DENFY4CRTIZL5WYYUYUM4VKCJNXO4QIW/
• https://metacpan.org/pod/App::cpanminus
• https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
• https://access.redhat.com/security/cve/cve-2020-16154
• https://security-tracker.debian.org/tracker/CVE-2020-16154
• https://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
• https://github.com/miyagawa/cpanminus/pull/638

The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers.

• https://github.com/miyagawa/cpanminus/issues/611
• https://github.com/miyagawa/cpanminus/pull/674
• https://security.metacpan.org/2024/08/26/cpanminus-downloads-code-using-insecure-http.html