CVE-2007-5034

Published: Sep 21, 2007Modified: Apr 23, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Affected (2)

Products: Elinks: Elinks

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Elinks Elinks	Up to 0.11.1
Elinks Elinks	Up to 0.11.2

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (40)

http://bugzilla.elinks.cz/show_bug.cgi?id=937

Source: security@ubuntu.com

http://secunia.com/advisories/26936

Source: security@ubuntu.com

http://secunia.com/advisories/26949

Source: security@ubuntu.com

http://secunia.com/advisories/26956

Source: security@ubuntu.com

http://secunia.com/advisories/27038

Source: security@ubuntu.com

http://secunia.com/advisories/27062

Source: security@ubuntu.com

http://secunia.com/advisories/27125

Source: security@ubuntu.com

http://secunia.com/advisories/27132

Source: security@ubuntu.com

http://www.debian.org/security/2007/dsa-1380

Source: security@ubuntu.com

http://www.redhat.com/support/errata/RHSA-2007-0933.html

Source: security@ubuntu.com

http://www.securityfocus.com/archive/1/481606/100/0/threaded

Source: security@ubuntu.com

http://www.securityfocus.com/bid/25799

Source: security@ubuntu.com

http://www.securitytracker.com/id?1018764

Source: security@ubuntu.com

http://www.ubuntu.com/usn/usn-519-1

Source: security@ubuntu.com

http://www.vupen.com/english/advisories/2007/3278

Source: security@ubuntu.com

https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018

Source: security@ubuntu.com

https://bugzilla.redhat.com/show_bug.cgi?id=297981

Source: security@ubuntu.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335

Source: security@ubuntu.com

https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html

Source: security@ubuntu.com

https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html

Source: security@ubuntu.com

http://bugzilla.elinks.cz/show_bug.cgi?id=937

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/26936

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/26949

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/26956

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27038

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27062

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27125

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/27132

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.debian.org/security/2007/dsa-1380

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.redhat.com/support/errata/RHSA-2007-0933.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/archive/1/481606/100/0/threaded

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/25799

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1018764

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/usn-519-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.vupen.com/english/advisories/2007/3278

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018

Source: af854a3a-2127-422b-91ae-364da2661108

https://bugzilla.redhat.com/show_bug.cgi?id=297981

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.