Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-21763

perl-HTTP-Tiny: man page not updated to reflect fix for CVE-2023-31486 [rhel-8]

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-8.10
    • rhel-8.10
    • perl-HTTP-Tiny
    • None
    • perl-HTTP-Tiny-0.074-3.el8
    • None
    • None
    • rhel-sst-cs-stacks
    • ssg_core_services
    • 20
    • 23
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • All
    • None

      To mitigate  CVE-2023-31486, the perl-HTTP-Tiny has been updated to perform SSL cert verification by default, ie verify_SSL=>true.

       

      However, the man page shipped with the package wasn't updated to reflect the change:

      $ man /usr/share/man/man3/HTTP::Tiny.3pm.gz
      ...

            -   "verify_SSL" — A boolean that indicates whether to validate the SSL certificate of an "https" — connection
                (default is false)
      ...

            [RHEL-21763] perl-HTTP-Tiny: man page not updated to reflect fix for CVE-2023-31486 [rhel-8]

            Errata Tool added a comment -

            Since the problem described in this issue should be resolved in a recent advisory, it has been closed.

            For information on the advisory (perl-HTTP-Tiny bug fix and enhancement update), and where to find the updated files, follow the link below.

            If the solution does not work for you, open a new bug report.
            https://access.redhat.com/errata/RHBA-2024:3206

            Errata Tool added a comment - Since the problem described in this issue should be resolved in a recent advisory, it has been closed. For information on the advisory (perl-HTTP-Tiny bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2024:3206

            Martin Kyral added a comment - - edited

            Verified manually on 1MT-RHEL-8.10.0-20240123.20:

            the man page in question now contains the following:

             

                  •   "verify_SSL" — A boolean that indicates whether to validate the SSL certificate of an "https" — connection
                      (default is true). Changed from false to true for CVE-2023-31486.

                  •   "SSL_options" — A hashref of "SSL_*" — options to pass through to IO::Socket::SSL

                  •   $ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT} — Changes the default certificate verification behavior to not
                      check server identity if set to 1. Only effective if "verify_SSL" is not set. Added for CVE-2023-31486.

             

            which reflects the change made to fix CVE-2023-31486

            Martin Kyral added a comment - - edited Verified manually on 1MT-RHEL-8.10.0-20240123.20: the man page in question now contains the following:         •   "verify_SSL" — A boolean that indicates whether to validate the SSL certificate of an "https" — connection           (default is true). Changed from false to true for CVE-2023-31486.       •   "SSL_options" — A hashref of "SSL_*" — options to pass through to IO::Socket::SSL       •   $ENV{PERL_HTTP_TINY_SSL_INSECURE_BY_DEFAULT} — Changes the default certificate verification behavior to not           check server identity if set to 1. Only effective if "verify_SSL" is not set. Added for CVE-2023-31486.   which reflects the change made to fix CVE-2023-31486

            gitlab-bot added a comment -

            Jitka Plesníková mentioned this issue in a merge request of Red Hat / centos-stream / rpms / perl-HTTP-Tiny on branch c8s-RHEL-21763:

            Resolves: RHEL-21763

            gitlab-bot added a comment - Jitka Plesníková mentioned this issue in a merge request of Red Hat / centos-stream / rpms / perl-HTTP-Tiny on branch c8s-RHEL-21763 : Resolves: RHEL-21763

              jplesnik@redhat.com Jitka Plesnikova
              mkyral@redhat.com Martin Kyral
              Jitka Plesnikova Jitka Plesnikova
              Martin Kyral Martin Kyral
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: