CVE-2013-2145: The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to...

Security readout for executives and security teams

CVE-2013-2145 affects Perl Module::Signature before 0.72. A malicious Perl package signature file could bypass signature verification and make the verification tool run attacker-controlled code. The practical concern is developer, build, or package-verification systems that process untrusted CPAN-style distributions. Likely exposure is limited to systems using Module::Signature before 0.72, especially developer workstations, CI/build hosts, or packaging systems that verify untrusted Perl distributions. Public web services are not directly implicated by the provided sources unless they process uploaded Perl package archives with cpansign verify. Prioritize remediation on build, release, and developer systems. The issue can undermine package trust checks and lead to code execution during verification, but the provided evidence does not indicate active exploitation or broad internet-facing exposure. Mitigation focus: Upgrade Module::Signature to version 0.72 or a vendor-fixed package.; Apply relevant distribution updates from Ubuntu, openSUSE, or other package vendors.; Avoid verifying untrusted Perl distributions on sensitive hosts until patched..

Prepared

Jun 14, 2026, 21:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.