PT-2011-2511 · Perl · Libwww-Perl

Aaron · Published 2011-05-13 · Updated 2018-10-30 · CVE-2011-0633

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libwww-perl (LWP) versions prior to 6.00

Description The issue allows remote attackers to conduct man-in-the-middle (MITM) attacks by spoofing servers due to inadequate validation of SSL certificates when the If-SSL-Cert-Subject header is not set. This occurs because the Net::HTTPS module does not enable full validation of SSL certificates by default in such environments.

Recommendations For versions prior to 6.00, update to version 6.00 or later to enable full validation of SSL certificates by default. As a temporary workaround, consider configuring the environment to set the If-SSL-Cert-Subject header to ensure proper validation of hostnames.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0633

Affected Products

Libwww-Perl

References · 8

• https://osv.dev/vulnerability/DEBIAN-CVE-2011-0633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0633 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-0633 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-0633 · Vendor Advisory
• http://vttynotes.blogspot.com/2011/03/quick-note-on-lwp-and-perl-security-cve.html · Note
• http://vttynotes.blogspot.com/2010/12/man-in-middle-fun-with-perl-lwp.html · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0633 · Note
• http://cpansearch.perl.org/src/GAAS/libwww-perl-6.02/Changes · Note