Summary
It was discovered that the LWP::Protocol::https perl module incorrectly
disabled peer certificate verification completely when only hostname
verification was requested to be disabled. If a remote attacker were able
to perform a machine-in-the-middle attack, this flaw could possibly be
exploited in certain scenarios to alter or compromise confidential
information in applications that used the LWP::Protocol::https module.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | liblwp-protocol-https-perl | 6.04-2ubuntu0.1 |
Vulnerabilities 1
-
Unscored —
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket cl…
References
-
report
https://ubuntu.com/security/CVE-2014-3230