CVE-2023-31486: 
NixOS vulnerability analysis and mitigation

HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must explicitly opt in to verify certificates when using HTTPS connections. The vulnerability was discovered in early 2023 and was assigned CVE-2023-31486 (NVD, Hackeriet Blog).

The vulnerability stems from HTTP::Tiny's default configuration where verifySSL is set to 0, requiring users to explicitly enable certificate verification by setting verifySSL=>1. This insecure default configuration affects both the standalone CPAN module and the version included in Perl core since version 5.13.9. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could lead to machine-in-the-middle attacks, potentially exposing sensitive information, allowing unauthorized modification of data, or causing denial of service. Over 300 CPAN distributions were identified as potentially affected, including critical modules that handle API secrets, financial information, and package management (Openwall, Hackeriet Blog).

The vulnerability has been fixed in HTTP::Tiny version 0.083, which changes the default verifySSL value to 1. For users who need to maintain backward compatibility, an environment variable PERLHTTPTINYSSLINSECUREBYDEFAULT=1 has been provided to restore the previous insecure default. Alternative mitigations include modifying affected code to explicitly set verifySSL=>1 or switching to HTTP clients with secure defaults like Mojo::UserAgent or LWP::UserAgent (Hackeriet Blog).

The vulnerability sparked significant discussion in the Perl community, with some questioning the CVE assignment process while others defended the classification of the insecure default as a legitimate security concern. The issue highlighted the broader challenge of balancing backward compatibility with security best practices in long-standing software projects (Openwall).