CVE-2014-3230 Security feature bypass in LWP::Protocol::https
Attackers can disable SSL certificate validation in libwww-perl by setting specific environment variables, allowing man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3230?
CVE-2014-3230 is a medium-severity vulnerability in libwww-perl LWP::Protocol::https, published on 28 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.
Weakness: CWE-295
Which versions are affected by CVE-2014-3230?
It affects 1 product.
Linux distribution packages (1)
perl-LWP-Protocol-https openSUSE:Tumbleweed | All versions | 6.06-1.4 |
Products include Lwp\ \.
How do I fix CVE-2014-3230?
Upgrade to a fixed version.
Is CVE-2014-3230 being exploited?
There is no known exploitation of CVE-2014-3230 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2014-3230, DEBIAN-CVE-2014-3230, GHSA-7x2q-v99p-jm92, MGASA-2014-0257, UBUNTU-CVE-2014-3230, USN-2292-1 and 1 more.