CVE-2014-3230

State: Published
Severity: Not scored
Published: Jan 28, 2020
Updated: Aug 6, 2024
Reserved: May 6, 2014

Description

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LWP::Protocol::httpslibwww-perl	6.04 through 6.06Affected

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579
https://github.com/libwww-perl/lwp-protocol-https/pull/14
http://www.openwall.com/lists/oss-security/2014/05/02/8
http://www.openwall.com/lists/oss-security/2014/05/04/1
http://www.openwall.com/lists/oss-security/2014/05/06/8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.