CVE-2014-3230

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-01-28 · updated 2026-06-17
Weakness: CWE-295

Description

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

Affected products

Lwp::Protocol::Https Project Lwp::Protocol::Https: from 6.04 through 6.06

References

http://www.openwall.com/lists/oss-security/2014/05/02/8
http://www.openwall.com/lists/oss-security/2014/05/04/1
http://www.openwall.com/lists/oss-security/2014/05/06/8
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579
https://github.com/libwww-perl/lwp-protocol-https/pull/14
http://www.openwall.com/lists/oss-security/2014/05/02/8
http://www.openwall.com/lists/oss-security/2014/05/04/1
http://www.openwall.com/lists/oss-security/2014/05/06/8
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746579
https://github.com/libwww-perl/lwp-protocol-https/pull/14

Get alerted when CVE-2014-3230 or the next vulnerability affects your stack