CVE-2014-3230

Publication date 7 May 2014

Last updated 24 July 2024

Ubuntu priority

Cvss 3 Severity Score

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
liblwp-protocol-https-perl	14.04 LTS trusty	Fixed 6.04-2ubuntu0.1
	13.10 saucy	Ignored
	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

jdstrand

per Debian, introduced by https://github.com/dagolden/lwp-protocol-https/commit/bcc46ce2dab53d2e2baa583f2243d6fc7d36dcc8 fix for https://rt.cpan.org/Public/Bug/Display.html?id=81948 introduced the bug (6.04)

mdeslaur

as of 2014-06-27, proposed patch is still being discussed

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
liblwp-protocol-https-perl	Vendor: https://github.com/libwww-perl/lwp-protocol-https/pull/14

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N