==========================================================================
Ubuntu Security Notice USN-2292-1
July 17, 2014
liblwp-protocol-https-perl vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 14.04 LTS
Summary:
LWP::Protocol::https could be made to expose sensitive information over the
network.
Software Description:
– liblwp-protocol-https-perl: HTTPS driver for LWP::UserAgent
Details:
It was discovered that the LWP::Protocol::https perl module incorrectly
disabled peer certificate verification completely when only hostname
verification was requested to be disabled. If a remote attacker were able
to perform a man-in-the-middle attack, this flaw could possibly be
exploited in certain scenarios to alter or compromise confidential
information in applications that used the LWP::Protocol::https module.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 14.04 LTS:
liblwp-protocol-https-perl 6.04-2ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-2292-1
CVE-2014-3230
Package Information:
https://launchpad.net/ubuntu/+source/liblwp-protocol-https-perl/6.04-2ubuntu0.1
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird – http://www.enigmail.net/
iQIcBAEBCgAGBQJTyA0SAAoJEGVp2FWnRL6TBBwQAIbyrMHI5pgMMBz1fIzKAX7q
NT0xfxENYoC7rwvk93ZtuMVhHJzHXZrRTYnPcswYOn/9n2PRDA13crGiIAM38p47
hjsCOjd/IeJzZhFyGftcOpDzohjY5wh64kc+juudSL+zl0e5JU8ade7QsWVnHoJe
Z53RqYrOk1mB27mBpCkW7ImCWSR8z9FMccKW8ixI87PvNVzPmr8OAOZFMMO0mJvH
Wm9jp5YVQCKVTYOBndeY+bmhkYATYwbNBVT+NChlUE12J3o03L8AQ924Llw4Q3fo
0e/l/k64715TMv9NOL72V85T0JLCLN8YD/1GY7GiSdobNdfeaTNdf8moje0DmYhD
TODQVjfAcl2cDMPmXk2tnBEPwfLYBV7OO+S0y7yXwSsv3Uct1TMZ+3+ZlAwlJeAY
scr0oj3Txk8clmtNzWfL2AaNavBL8Eozo3hibCjiWJp+a7QfVoFG0AUjx4hOh/CS
ZSGbEpRaaQ/xg4hrXAnEW70LQWBws3Q1kikJkHMog2gNRdudb2j+E0Fid6hkDZQm
cEFthDvHe/vkVPhmTl16hSoG0XiutP5sRlJUPArQb89iysoSaEnPR782cdpJTWlP
MU5Lc/GgCnJfv3AWGhuUPfXMQ79AflJenVRiOgvIcSHf4kSd+5FvgIYROytVVbeN
yHM6u0Nj7Z4BAfJUKaaD
=qTWT
—–END PGP SIGNATURE—–
—
