Resolves: RHEL-9468 - Add verify_SSL=1 by default

CPAN-2.35-Add-verify-SSL.patch

@@ -0,0 +1,11 @@
+diff -up CPAN-2.16/lib/CPAN/HTTP/Client.pm.orig CPAN-2.16/lib/CPAN/HTTP/Client.pm
+--- CPAN-2.16/lib/CPAN/HTTP/Client.pm.orig	2024-01-17 13:58:05.321031493 +0100
++++ CPAN-2.16/lib/CPAN/HTTP/Client.pm	2024-01-17 14:07:36.657874287 +0100
+@@ -32,6 +32,7 @@ sub mirror {
+ 
+     my $want_proxy = $self->_want_proxy($uri);
+     my $http = HTTP::Tiny->new(
++		verify_SSL => 1,
+         $want_proxy ? (proxy => $self->{proxy}) : ()
+     );
+ 

perl-CPAN.spec

@@ -12,7 +12,7 @@
 
 Name:           perl-CPAN
 Version:        2.18
-Release:        397%{?dist}
+Release:        398%{?dist}
 Summary:        Query, download and build perl modules from CPAN sites
 License:        GPL+ or Artistic
 URL:            http://search.cpan.org/dist/CPAN/
@@ -27,6 +27,8 @@ Patch2:         CPAN-2.18-Replace-configuration-directory-string-with-a-marke.pa
 # Do not search cpan -j file in @INC, CPAN RT#116507, proposed in
 # <https://github.com/andk/cpanpm/pull/105>
 Patch3:         CPAN-2.18-For-cpan-j-make-the-file-an-absolute-path.patch
+# CVE-2023-31484 - Add verify_SSL => 1
+Patch4:         CPAN-2.35-Add-verify-SSL.patch
 BuildArch:      noarch
 BuildRequires:  coreutils
 BuildRequires:  findutils
@@ -214,10 +216,11 @@ external download clients to fetch distributions from the net.
 
 %prep
 %setup -q -n CPAN-%{cpan_version}
-%patch0 -p1
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
+%patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
 # Change configuration name
 find -type f -exec sed -i -e 's/XCPANCONFIGNAMEX/cpan/g' {} \;
 # Remove bundled modules
@@ -244,6 +247,9 @@ make test
 %{_mandir}/man3/*
 
 %changelog
+* Thu Jan 18 2024 Jitka Plesnikova <jplesnik@redhat.com> - 2.18-397
+- Fix CVE-2023-31484
+
 * Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.18-397
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild