mirror of
https://git.yoctoproject.org/poky
synced 2026-01-29 21:08:42 +01:00
CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS. HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates. References: https://nvd.nist.gov/vuln/detail/CVE-2023-31484 https://nvd.nist.gov/vuln/detail/CVE-2023-31486 Upstream patches:9c9837028777f557ef84a22785783b(From OE-Core rev: f4fe9861d6aebd971a3120a0eb43f752c73ce2fb) Signed-off-by: Soumya <soumya.sambu@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>