CVE-2011-0633 Security feature bypass in n/a
Remote attackers can spoof servers via man-in-the-middle attacks because the library does not validate SSL certificates by default.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-0633?
CVE-2011-0633 is a medium-severity vulnerability in n/a, published on 13 May 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated. NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.
Weakness: CWE-20
Which versions are affected by CVE-2011-0633?
It affects 2 products.
Products include Gisle Aas Libwww-Perl, Search.cpan Libwww-Perl.
How do I fix CVE-2011-0633?
Upgrade to a fixed version.
Is CVE-2011-0633 being exploited?
There is no known exploitation of CVE-2011-0633 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2011-0633, GHSA-3fhh-g5rg-6jpm.