CVE-2014-3230

Published: Jan 28, 2020Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

Affected (1)

Products: Lwp\: \

Lwp\

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lwp\ \	From 6.04 to 6.06

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (10)

http://www.openwall.com/lists/oss-security/2014/05/02/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/05/04/1

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2014/05/06/8

Source: secalert@redhat.com

Mailing ListThird Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579

Source: secalert@redhat.com

ExploitMailing ListPatchThird Party Advisory

https://github.com/libwww-perl/lwp-protocol-https/pull/14

Source: secalert@redhat.com

Broken Link

http://www.openwall.com/lists/oss-security/2014/05/02/8