CVE-2014-3230 The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_...
MediumCVSS 5.9
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/liblwp-protocol-https-perl(Debian:12) | < 6.04-3 | 6.04-3 |
| debian/liblwp-protocol-https-perl(Debian:13) | < 6.04-3 | 6.04-3 |
| debian/liblwp-protocol-https-perl(Debian:14) | < 6.04-3 | 6.04-3 |
| lwpprotocolhttps project lwpprotocolhttps | >= 6.04, <= 6.06 | No fix listed |
| alpine/perl-lwp-protocol-https(Alpine:v3.19) | < 6.11-r0 | 6.11-r0 |
| alpine/perl-lwp-protocol-https(Alpine:v3.20) | < 6.11-r0 | 6.11-r0 |
| alpine/perl-lwp-protocol-https(Alpine:v3.21) | < 6.11-r0 | 6.11-r0 |
| alpine/perl-lwp-protocol-https(Alpine:v3.22) | < 6.11-r0 | 6.11-r0 |
| alpine/perl-lwp-protocol-https(Alpine:v3.23) | < 6.11-r0 | 6.11-r0 |
| alpine/perl-lwp-protocol-https(Alpine:v3.24) | < 6.11-r0 | 6.11-r0 |
| libwww-perl LWP::Protocol::https | = 6.04 through 6.06 | No fix listed |
References
- Debian Security Tracker CVE-2014-3230 vendor-advisory
- www.openwall.com mailing-list third-party-advisory
- www.openwall.com mailing-list patch third-party-advisory
- www.openwall.com mailing-list third-party-advisory
- bugs.debian.org exploit mailing-list patch third-party-advisory
- github.com broken-link
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking