CVE catalog
CVE-2011-0633
libwww-perl: CVE-2011-0633
- Severity
- Medium
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 4.25% · Oct 25, 2026
The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated. NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | libwww-perl | sid | 6.83-1 | fixed |
| Debian | libwww-perl | forky | 6.83-1 | fixed |
| Debian | libwww-perl | trixie | 6.78-1 | fixed |
| Debian | libwww-perl | bookworm | 6.68-1 | fixed |
Fixed-version evidence
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [libwww-perl]Fixed
Details (2)
6.68-1· all · bookwormFixed · Fixed:
6.01-1dsa · libwww-perl · debian · bookworm; dsa · libwww-perl · debian · 12
6.68-1· all · bookwormFixed · Fixed:
6.01-1dsa · libwww-perl · debian · bookworm; dsa · libwww-perl · debian · 12
[Debian 13 (Trixie)]
- [libwww-perl]Fixed
Details (2)
6.78-1· all · trixieFixed · Fixed:
6.01-1dsa · libwww-perl · debian · 13
6.78-1· all · trixieFixed · Fixed:
6.01-1dsa · libwww-perl · debian · 13
Observed: