G'day AM,

No worries about "3 years later" -- for various personal reasons, this is the first time I've logged in for over six months.

In my original post, I had requested others to report their findings on other systems. Your feedback re Ubuntu is very much appreciated; it's also prompted to me to add a new note about openSUSE (which I've been setting up for $work recently).

You may find the following CVEs of interest: CVE-2020-16156 and CVE-2023-31484.

Here's my current cpan shell setup (locally on Cygwin with Perl v5.40.0) for the configuration items you discussed:

$ perl -v | head -2 | tail -1
This is perl 5, version 40, subversion 0 (v5.40.0) built for cygwin-th
+read-multi

ken@titan ~/tmp
$ cpan

cpan shell -- CPAN exploration and modules installation (v2.36)
Enter 'h' for help.

cpan[1]> o conf pushy_https
    pushy_https        [0]
Type 'o conf' to view all configuration items


cpan[2]> o conf urllist
    urllist
        0 [https://www.cpan.org/]
        1 [https://cpan.metacpan.org/]
Type 'o conf' to view all configuration items


cpan[3]> q
Lockfile removed.

ken@titan ~/tmp
[download]

Update: Added perl -v ... command.