PT-2014-5152 · Perl+1 · Libwww-Perl+1

Publicado 2014-05-07 · Atualizado 2024-06-15 · CVE-2014-3230

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libwww-perl LWP::Protocol::https module versions 6.04 through 6.06

Description The issue allows attackers to disable server certificate validation via the HTTPS CA DIR or HTTPS CA FILE environment variable when using IO::Socket::SSL as the SSL socket class.

Recommendations For versions 6.04 through 6.06, consider disabling the use of the HTTPS CA DIR and HTTPS CA FILE environment variables to prevent server certificate validation from being disabled until a patch is available. Restrict access to the environment variables to minimize the risk of exploitation.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2014-3230

MGASA-2014-0257

OPENSUSE-SU-2024:10239-1

USN-2292-1

Produtos afetados

Ubuntu

Libwww-Perl

Referências · 24

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579 · Exploit
• https://github.com/libwww-perl/lwp-protocol-https/pull/14 · Nota
• https://osv.dev/vulnerability/CVE-2014-3230 · Aviso do Fabricante
• https://t.me/cvenotify/526 · Publicação no Telegram
• https://advisories.mageia.org/MGASA-2014-0257.html · Nota de Segurança
• https://bugs.mageia.org/show_bug.cgi?id=13425 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3230 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-3230 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/05/06/8 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10239-1 · Aviso do Fabricante
• https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133535.html · Aviso do Fabricante
• https://osv.dev/vulnerability/ALPINE-CVE-2014-3230 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-3230 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-3230 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3230 · Aviso do Fabricante