PT-2014-5152 · Perl+1 · Libwww-Perl+1

Published 2014-05-07 · Updated 2024-06-15 · CVE-2014-3230

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions libwww-perl LWP::Protocol::https module versions 6.04 through 6.06

Description The issue allows attackers to disable server certificate validation via the HTTPS CA DIR or HTTPS CA FILE environment variable when using IO::Socket::SSL as the SSL socket class.

Recommendations For versions 6.04 through 6.06, consider disabling the use of the HTTPS CA DIR and HTTPS CA FILE environment variables to prevent server certificate validation from being disabled until a patch is available. Restrict access to the environment variables to minimize the risk of exploitation.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2014-3230

MGASA-2014-0257

OPENSUSE-SU-2024:10239-1

USN-2292-1

Affected Products

Ubuntu

Libwww-Perl

References · 24

• 🔥 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579 · Exploit
• https://osv.dev/vulnerability/CVE-2014-3230 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0257.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3230 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-3230 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10239-1 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-May/133535.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2014-3230 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-3230 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-3230 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3230 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3230 · Vendor Advisory
• http://openwall.com/lists/oss-security/2014/05/04/1 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3230 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2292-1 · Vendor Advisory