CPAN Security Group
Welcome to the CPAN Security Group. This is a community effort for supporting and responding to security incidents on CPAN β the Comprehensive Perl Archive Network.
This group also cares about security-related topics around CPAN distributions, the CPAN/PAUSE infrastructure, and about tooling and the ecosystem in general. Over time, we aim to improve supply chain security, make CPAN a more secure and trustworthy publishing platform, and more.
Learn more & Contribute
On CPAN, improving security is a volunteer-driven collaborative effort. If you care and would like to make a contribution, you canβ¦
- Explore our main website
- Check us out on Github
- Join us in our Matrix channel, #cpansec-discussion on matrix.org
- Join us in our IRC channel, #cpan-security on irc.perl.org
- Send an e-mail to the CPAN Security Group <cpan-security@perl.org> π§
- Subscribe to @cpan_security@perl.social on the Fediverse :elephant:
Resources
- Projects overview on Github
- Documents & Guides, and other relevant resources
- How to Report a Security Issue
- Pre-Release Disclosure Agreement
- Group charter β οΈ DRAFT
- Standards and regulations reading list β οΈ DRAFT
- Meetings information and minutes
- Presentations about us and our work
CPANSec News
App::cpanminus through 1.7047 downloads code using insecure HTTP
CVE-2024-45321: In its default configuration cpanminus uses insecure HTTP to download and install code from CPAN. This results in a CWE-494 weakness, enabling code execution for network attackers.
Vulnerable Spreadsheet Parsing modules
Between Dec 2023 and Jan 2024, vulnerabilities in Spreadsheet::ParseExcel and Spreadsheet::ParseXLSX were reported to the CPAN Security Group (CPANSec). This document describes the timeline and analysis of events.
Introducing the CPAN Security Group
There's a new group in the Perl + CPAN communities!
subscribe via RSS