Insecure Server Certificate Validation in libwww-perl LWP::Protocol::https
Summary
CVE-2014-3230: The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_... Affects perl-lwp-protocol-https versions < 6.11-r0. Fixed in 6.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libwww-perl LWP::Protocol::https module is a Perl library that provides support for making HTTPS requests. It relies on the IO::Socket::SSL module as the SSL socket class. The module is commonly used in Perl applications to interact with web services and APIs over secure connections. However, versions 6.04 through 6.06 of the module are vulnerable to a security issue that allows attackers to disable server certificate validation.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3230, arises from the improper handling of server certificate validation in the libwww-perl LWP::Protocol::https module. When using the IO::Socket::SSL module as the SSL socket class, the module fails to properly validate server certificates. This can be exploited by attackers who can set the HTTPS_CA_DIR or HTTPS_CA_FILE environment variables to bypass server certificate validation. As a result, an attacker could establish a connection to a malicious server without the user being alerted to the invalid or untrusted certificate. This could lead to various security risks, including man-in-the-middle attacks and data interception.
How To Fix
Minimum fixed version
6.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade perl-lwp-protocol-httpsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, a temporary workaround is to manually validate server certificates within the application code. This can be done by implementing custom certificate validation logic using the IO::Socket::SSL module or by using alternative libraries that provide proper server certificate validation.
Conclusion
Insecure server certificate validation in the libwww-perl LWP::Protocol::https module poses a significant security risk, allowing attackers to bypass server certificate validation. It is crucial to upgrade to a fixed version of the module or implement appropriate certificate validation logic to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for perl-lwp-protocol-https →
FAQ
The vulnerability allows attackers to disable server certificate validation, potentially leading to man-in-the-middle attacks and data interception.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and Vulert will analyze it for open-source vulnerabilities in real-time.
Yes, the CVSS score for this vulnerability is 5.9.
While specific exploits for this vulnerability may exist, there are no publicly known exploits at the time of this report. However, it is important to address the vulnerability promptly to mitigate the risk.
If upgrading to a fixed version is not immediately possible, you can implement custom certificate validation logic within your application code or consider using alternative libraries that provide proper server certificate validation.
Related vulnerabilities
Recent vulnerabilities recorded for perl-lwp-protocol-https.
