CVE-2023-31485: debian/libgitlab-api-v4-perl may trust fake certificates

The Perl library used to talk to GitLab (versions up to 0.26) does not check the authenticity of TLS certificates. An attacker who can intercept the network could pretend to be the GitLab server and read or modify data. Upgrade the library to a newer version or configure it to enforce proper certificate verification.

• https://www.openwall.com/lists/oss-security/2023/04/18/14 URL
• https://github.com/bluefeet/GitLab-API-v4/pull/57 Patch
• https://github.com/chansen/p5-http-tiny/pull/151 Patch
• http://www.openwall.com/lists/oss-security/2023/04/29/1 Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/05/03/3 Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/05/03/5 Third Party Advisory
• http://www.openwall.com/lists/oss-security/2023/05/07/2 Third Party Advisory
• https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modul... Third Party Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-31485 Vendor Advisory
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/31xxx/CVE-2023-31485... Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31485 Vendor Advisory