CVE-2014-3230

Опубликовано: 28 янв. 2020

Источник: nvd

CVSS3: 5.9

CVSS2: 4.3

EPSS Низкий

Описание

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

Ссылки

http://www.openwall.com/lists/oss-security/2014/05/02/8
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/04/1
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/06/8
Mailing List
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579
Exploit
Mailing List
Patch
Third Party Advisory
https://github.com/libwww-perl/lwp-protocol-https/pull/14
Broken Link
http://www.openwall.com/lists/oss-security/2014/05/02/8
Mailing List
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/04/1
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/05/06/8
Mailing List
Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579
Exploit
Mailing List
Patch
Third Party Advisory
https://github.com/libwww-perl/lwp-protocol-https/pull/14
Broken Link

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:lwp\:\:protocol\:\:https_project:lwp\:\:protocol\:\:https:*:*:*:*:*:*:*:*

Версия от 6.04 (включая) до 6.06 (включая)

EPSS

Процентиль: 56%

0.00344

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

CVE-2014-3230

CVSS3: 5.9

ubuntu

около 6 лет назад

CVE-2014-3230

redhat

почти 12 лет назад

CVE-2014-3230

CVSS3: 5.9

debian

около 6 лет назад

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl ...

GHSA-7x2q-v99p-jm92

github

больше 3 лет назад

EPSS

Процентиль: 56%

0.00344

Низкий

5.9 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-295