PT-2011-2511 · Perl · Libwww-Perl

Aaron · Publicado 2011-05-13 · Atualizado 2018-10-30 · CVE-2011-0633

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libwww-perl (LWP) versions prior to 6.00

Description The issue allows remote attackers to conduct man-in-the-middle (MITM) attacks by spoofing servers due to inadequate validation of SSL certificates when the If-SSL-Cert-Subject header is not set. This occurs because the Net::HTTPS module does not enable full validation of SSL certificates by default in such environments.

Recommendations For versions prior to 6.00, update to version 6.00 or later to enable full validation of SSL certificates by default. As a temporary workaround, consider configuring the environment to set the If-SSL-Cert-Subject header to ensure proper validation of hostnames.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-0633

Produtos afetados

Libwww-Perl

Referências · 8

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0633 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0633 · Nota de Segurança
• http://vttynotes.blogspot.com/2011/03/quick-note-on-lwp-and-perl-security-cve.html · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-0633 · Aviso do Fabricante
• http://vttynotes.blogspot.com/2010/12/man-in-middle-fun-with-perl-lwp.html · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0633 · Nota
• http://cpansearch.perl.org/src/GAAS/libwww-perl-6.02/Changes · Nota
• https://osv.dev/vulnerability/CVE-2011-0633 · Aviso do Fabricante