Critical Vulnerability in perl-lwp-protocol-https: Server Certificate Validation Bypass
Summary
ALPINE-CVE-2014-3230: The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_... Affects perl-lwp-protocol-https versions < 6.11-r0. Fixed in 6.11-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The perl-lwp-protocol-https package is a Perl module that provides support for HTTPS requests in the libwww-perl library. It allows Perl applications to communicate securely over the web using SSL/TLS protocols. This package is widely used in various applications that require secure data transmission. However, it has been identified to have a vulnerability that can compromise the security of applications relying on it.
Vulnerability Detail
The vulnerability, identified as CVE-2014-3230, affects versions 6.04 through 6.06 of the LWP::Protocol::https module when using IO::Socket::SSL as the SSL socket class. Attackers can exploit this vulnerability to disable server certificate validation by manipulating the HTTPS_CA_DIR or HTTPS_CA_FILE environment variables. This can lead to man-in-the-middle attacks, allowing attackers to intercept and manipulate secure communications without detection.
How To Fix
Minimum fixed version
6.11-r0
This is the first release that contains the fix.
sudo apk add --upgrade perl-lwp-protocol-httpsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can avoid using the HTTPS_CA_DIR and HTTPS_CA_FILE environment variables to prevent the disabling of server certificate validation. However, this is not a permanent solution and updating the package is highly recommended.
Conclusion
The perl-lwp-protocol-https package has a critical vulnerability that can compromise secure communications in applications. It is crucial to update to the patched version 6.11-r0 to mitigate the risk of exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for perl-lwp-protocol-https →
FAQ
CVE-2014-3230 is a vulnerability in the perl-lwp-protocol-https package that allows attackers to bypass server certificate validation.
If exploited, this vulnerability can lead to man-in-the-middle attacks, compromising the confidentiality and integrity of data transmitted over HTTPS.
Versions 6.04 through 6.06 of the perl-lwp-protocol-https package are affected by this vulnerability.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for perl-lwp-protocol-https.
