CVE-2020-16156 – CVE-2020-16156 is a signature verification bypa... (How to Fix)

📋 TL;DR

CVE-2020-16156 is a signature verification bypass vulnerability in CPAN (Comprehensive Perl Archive Network) version 2.28. Attackers can craft malicious CPAN packages that bypass cryptographic signature checks, potentially leading to installation of compromised Perl modules. This affects systems using CPAN to install Perl modules without additional verification mechanisms.

💻 Affected Systems

Products:

CPAN (Comprehensive Perl Archive Network)

Versions: Version 2.28 specifically

Operating Systems: All operating systems running Perl with CPAN

Default Config Vulnerable: ⚠️ Yes

Notes: Affects systems using CPAN.pm module for Perl module installation. Systems using cpanm (App::cpanminus) are not affected.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could distribute malicious Perl modules that execute arbitrary code during installation, potentially leading to full system compromise, data theft, or lateral movement within networks.

🟠

Likely Case

Supply chain attack where attackers compromise popular Perl modules, leading to malware installation on developer systems and potentially production environments.

🟢

If Mitigated

With proper controls like network segmentation and strict package source verification, impact is limited to isolated development environments.

🌐 Internet-Facing: MEDIUM - CPAN clients typically fetch packages from internet repositories, making them vulnerable to man-in-the-middle attacks or compromised repositories.

🏢 Internal Only: LOW - Internal systems not using CPAN or using verified internal mirrors are less exposed.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires ability to modify CPAN packages or intercept network traffic to CPAN repositories. Public technical details available in referenced blog posts.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: CPAN 2.29 and later

Vendor Advisory: https://metacpan.org/pod/distribution/CPAN/scripts/cpan

Restart Required: No

Instructions:

1. Update CPAN module: cpan CPAN
2. Verify update: perl -MCPAN -e 'print $CPAN::VERSION'
3. Ensure version is 2.29 or higher

🔧 Temporary Workarounds

Use cpanminus instead

all

Switch from CPAN.pm to App::cpanminus which is not vulnerable

cpan App::cpanminus
alias cpan='cpanm'

Use trusted CPAN mirrors

all

Configure CPAN to use only trusted, verified mirrors

o conf urllist unshift https://trusted.cpan.mirror/
o conf commit

🧯 If You Can't Patch

Disable signature checking entirely (not recommended for security)
Use offline installation from verified sources only

🔍 How to Verify

Check if Vulnerable:

Check CPAN version: perl -MCPAN -e 'print $CPAN::VERSION' - if output is 2.28, system is vulnerable

Check Version:

perl -MCPAN -e 'print $CPAN::VERSION'

Verify Fix Applied:

After update, verify version is 2.29 or higher using same command

📡 Detection & Monitoring

Log Indicators:

Failed signature verification attempts
Unexpected CPAN package installations
CPAN downloads from unusual sources

SIEM Query:

process_name:cpan AND (event_type:install OR event_type:download) AND NOT signature:verified

📊 Metadata

CVE ID: CVE-2020-16156

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-347

Published: December 13, 2021

Last Updated: November 3, 2025

🔗 References

http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html Exploit,Third Party Advisory
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/ Exploit,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
https://metacpan.org/pod/distribution/CPAN/scripts/cpan Product,Third Party Advisory
http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html Exploit,Third Party Advisory
https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/ Exploit,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
https://metacpan.org/pod/distribution/CPAN/scripts/cpan Product,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-16156, you might also want to check these: