Perl HTTP::Tiny has insecure TLS default, affecting CPAN.pm and other modules
UPDATE 2023-06-12: v0.083-TRIAL has been released with a fix. [CVE-2023-31486] HTTP::Tiny v0.082, is a http client included in Perl (since v5.13.9) and also a standalone CPAN module. It does not verify TLS certificates by default requiring users to opt-in with the verify_SSL=>1 flag to verify the identity of the HTTPS server they are communicating with. The module is used by many distributions on CPAN, and likely other open source and proprietary software. NOTE: This post summarizes security problems caused by the insecure default and how it affects code relying on it for https. For a discussion on how this is being addressed upstream, please see RFC: Making SSL_verify safer Affected CPAN Modules After PSA: HTTP::Tiny disabled SSL verification by default! was posted on Reddit, we were reminded that this might be a bigger problem than first thought. So we searched trough metacpan-cpan-extracted to find distributions using HTTP::Tiny without specifying the cert verification behaviour. Distros using it without mentioning verify_SSL somewhere in the code was flagged. See