CVE-2011-0633 The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does...
MediumCVSS 4.3
EPSS 4.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated. NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gisle aas libwww-perl | = 0.01 | No fix listed |
| gisle aas libwww-perl | = 0.02 | No fix listed |
| gisle aas libwww-perl | = 0.03 | No fix listed |
| gisle aas libwww-perl | = 0.04 | No fix listed |
| gisle aas libwww-perl | = 5.00 | No fix listed |
| gisle aas libwww-perl | = 5.01 | No fix listed |
| gisle aas libwww-perl | = 5.02 | No fix listed |
| gisle aas libwww-perl | = 5.03 | No fix listed |
| gisle aas libwww-perl | = 5.04 | No fix listed |
| gisle aas libwww-perl | = 5.05 | No fix listed |
| gisle aas libwww-perl | = 5.06 | No fix listed |
| gisle aas libwww-perl | = 5.07 | No fix listed |
| gisle aas libwww-perl | = 5.08 | No fix listed |
| gisle aas libwww-perl | = 5.09 | No fix listed |
| gisle aas libwww-perl | = 5.10 | No fix listed |
| gisle aas libwww-perl | = 5.11 | No fix listed |
| gisle aas libwww-perl | = 5.12 | No fix listed |
| gisle aas libwww-perl | = 5.13 | No fix listed |
| gisle aas libwww-perl | = 5.14 | No fix listed |
| gisle aas libwww-perl | = 5.15 | No fix listed |
| gisle aas libwww-perl | = 5.16 | No fix listed |
| gisle aas libwww-perl | = 5.17 | No fix listed |
| gisle aas libwww-perl | = 5.18 | No fix listed |
| gisle aas libwww-perl | = 5.18_03 | No fix listed |
| gisle aas libwww-perl | = 5.18_04 | No fix listed |
Show 102 more
| Product | Affected versions | Fixed in |
|---|---|---|
| gisle aas libwww-perl | = 5.18_05 | No fix listed |
| gisle aas libwww-perl | = 5.19 | No fix listed |
| gisle aas libwww-perl | = 5.20 | No fix listed |
| gisle aas libwww-perl | = 5.21 | No fix listed |
| gisle aas libwww-perl | = 5.22 | No fix listed |
| gisle aas libwww-perl | = 5.30 | No fix listed |
| gisle aas libwww-perl | = 5.31 | No fix listed |
| gisle aas libwww-perl | = 5.32 | No fix listed |
| gisle aas libwww-perl | = 5.33 | No fix listed |
| gisle aas libwww-perl | = 5.34 | No fix listed |
| gisle aas libwww-perl | = 5.35 | No fix listed |
| gisle aas libwww-perl | = 5.36 | No fix listed |
| gisle aas libwww-perl | = 5.41 | No fix listed |
| gisle aas libwww-perl | = 5.42 | No fix listed |
| gisle aas libwww-perl | = 5.43 | No fix listed |
| gisle aas libwww-perl | = 5.44 | No fix listed |
| gisle aas libwww-perl | = 5.45 | No fix listed |
| gisle aas libwww-perl | = 5.46 | No fix listed |
| gisle aas libwww-perl | = 5.47 | No fix listed |
| gisle aas libwww-perl | = 5.48 | No fix listed |
| gisle aas libwww-perl | = 5.49 | No fix listed |
| gisle aas libwww-perl | = 5.50 | No fix listed |
| gisle aas libwww-perl | = 5.51 | No fix listed |
| gisle aas libwww-perl | = 5.52 | No fix listed |
| gisle aas libwww-perl | = 5.53 | No fix listed |
| gisle aas libwww-perl | = 5.53_90 | No fix listed |
| gisle aas libwww-perl | = 5.53_91 | No fix listed |
| gisle aas libwww-perl | = 5.53_92 | No fix listed |
| gisle aas libwww-perl | = 5.53_93 | No fix listed |
| gisle aas libwww-perl | = 5.53_94 | No fix listed |
| gisle aas libwww-perl | = 5.53_95 | No fix listed |
| gisle aas libwww-perl | = 5.53_96 | No fix listed |
| gisle aas libwww-perl | = 5.53_97 | No fix listed |
| gisle aas libwww-perl | = 5.60 | No fix listed |
| gisle aas libwww-perl | = 5.61 | No fix listed |
| gisle aas libwww-perl | = 5.62 | No fix listed |
| gisle aas libwww-perl | = 5.63 | No fix listed |
| gisle aas libwww-perl | = 5.64 | No fix listed |
| gisle aas libwww-perl | = 5.65 | No fix listed |
| gisle aas libwww-perl | = 5.66 | No fix listed |
| gisle aas libwww-perl | = 5.67 | No fix listed |
| gisle aas libwww-perl | = 5.68 | No fix listed |
| gisle aas libwww-perl | = 5.69 | No fix listed |
| gisle aas libwww-perl | = 5.70 | No fix listed |
| gisle aas libwww-perl | = 5.71 | No fix listed |
| gisle aas libwww-perl | = 5.72 | No fix listed |
| gisle aas libwww-perl | = 5.73 | No fix listed |
| gisle aas libwww-perl | = 5.74 | No fix listed |
| gisle aas libwww-perl | = 5.75 | No fix listed |
| gisle aas libwww-perl | = 5.76 | No fix listed |
| gisle aas libwww-perl | = 5.77 | No fix listed |
| gisle aas libwww-perl | = 5.78 | No fix listed |
| gisle aas libwww-perl | = 5.79 | No fix listed |
| gisle aas libwww-perl | = 5.800 | No fix listed |
| gisle aas libwww-perl | = 5.801 | No fix listed |
| gisle aas libwww-perl | = 5.802 | No fix listed |
| gisle aas libwww-perl | = 5.803 | No fix listed |
| gisle aas libwww-perl | = 5.804 | No fix listed |
| gisle aas libwww-perl | = 5.805 | No fix listed |
| gisle aas libwww-perl | = 5.806 | No fix listed |
| gisle aas libwww-perl | = 5.807 | No fix listed |
| gisle aas libwww-perl | = 5.808 | No fix listed |
| gisle aas libwww-perl | = 5.810 | No fix listed |
| gisle aas libwww-perl | = 5.811 | No fix listed |
| gisle aas libwww-perl | = 5.812 | No fix listed |
| gisle aas libwww-perl | = 5.813 | No fix listed |
| gisle aas libwww-perl | = 5.814 | No fix listed |
| gisle aas libwww-perl | = 5.815 | No fix listed |
| gisle aas libwww-perl | = 5.816 | No fix listed |
| gisle aas libwww-perl | = 5.817 | No fix listed |
| gisle aas libwww-perl | = 5.818 | No fix listed |
| gisle aas libwww-perl | = 5.819 | No fix listed |
| gisle aas libwww-perl | = 5.820 | No fix listed |
| gisle aas libwww-perl | = 5.821 | No fix listed |
| gisle aas libwww-perl | = 5.822 | No fix listed |
| gisle aas libwww-perl | = 5.823 | No fix listed |
| gisle aas libwww-perl | = 5.824 | No fix listed |
| gisle aas libwww-perl | = 5.825 | No fix listed |
| gisle aas libwww-perl | = 5.826 | No fix listed |
| gisle aas libwww-perl | = 5.827 | No fix listed |
| gisle aas libwww-perl | = 5.828 | No fix listed |
| gisle aas libwww-perl | = 5.829 | No fix listed |
| gisle aas libwww-perl | = 5.830 | No fix listed |
| gisle aas libwww-perl | = 5.831 | No fix listed |
| gisle aas libwww-perl | = 5.832 | No fix listed |
| gisle aas libwww-perl | = 5.833 | No fix listed |
| gisle aas libwww-perl | = 5.834 | No fix listed |
| gisle aas libwww-perl | = 5.836 | No fix listed |
| gisle aas libwww-perl | = 5b5 | No fix listed |
| gisle aas libwww-perl | = 5b6 | No fix listed |
| gisle aas libwww-perl | = 5b7 | No fix listed |
| gisle aas libwww-perl | = 5b8 | No fix listed |
| gisle aas libwww-perl | = 5b9 | No fix listed |
| gisle aas libwww-perl | = 5b10 | No fix listed |
| gisle aas libwww-perl | = 5b11 | No fix listed |
| gisle aas libwww-perl | = 5b12 | No fix listed |
| gisle aas libwww-perl | = 5b13 | No fix listed |
| search.cpan libwww-perl | <= 5.837 | No fix listed |
| search.cpan libwww-perl | = 5.40_01 | No fix listed |
| debian/libwww-perl(Debian:12) | < 6.01-1 | 6.01-1 |
| debian/libwww-perl(Debian:13) | < 6.01-1 | 6.01-1 |
| debian/libwww-perl(Debian:14) | < 6.01-1 | 6.01-1 |
References
- cpansearch.perl.org
- vttynotes.blogspot.com
- vttynotes.blogspot.com
- Debian Security Tracker CVE-2011-0633 vendor-advisory
- bugs.debian.org issue-tracking