CPANSA-Catalyst-Plugin-Static-Simple.yml

---
- id: CPANSA-Catalyst-Plugin-Static-Simple-2017-01
  distribution: Catalyst-Plugin-Static-Simple
  reported: 2017-10-31
  description: >
    The Catalyst-Plugin-Static-Simple module before 0.34 for Perl
    allows remote attackers to read arbitrary files if there is a '.'
    character anywhere in the pathname, which differs from the
    intended policy of allowing access only when the filename itself
    has a '.' character.
  references:
    - https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
    - https://metacpan.org/pod/CPAN::Checksums
  cves:
    - CVE-2017-16248
  affected_versions: "<0.34"
  fixed_versions: ">=0.34"