CVE catalog

CVE-2014-3230

liblwp-protocol-https-perl: CVE-2014-3230

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.34% · Oct 25, 2026

The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianliblwp-protocol-https-perlsid6.17-1fixed
Debianliblwp-protocol-https-perlforky6.15-1fixed
Debianliblwp-protocol-https-perltrixie6.14-1fixed
Debianliblwp-protocol-https-perlbookworm6.10-1fixed
Alpineperl-lwp-protocol-https3.196.11-r0fixed
Alpineperl-lwp-protocol-https3.206.11-r0fixed
Alpineperl-lwp-protocol-https3.216.11-r0fixed
Alpineperl-lwp-protocol-https3.226.11-r0fixed
Alpineperl-lwp-protocol-https3.236.11-r0fixed
Alpineperl-lwp-protocol-https3.246.11-r0fixed
Ubuntuliblwp-protocol-https-perl14.046.04-1vulnerable
Ubuntuliblwp-protocol-https-perl14.046.04-2vulnerable
Ubuntuliblwp-protocol-https-perl14.046.04-2ubuntu0.1fixed
Ubuntuliblwp-protocol-https-perl14.046.04-1vulnerable
Ubuntuliblwp-protocol-https-perl14.046.04-2vulnerable
Ubuntuliblwp-protocol-https-perl14.046.04-2ubuntu0.1fixed
Opensuseperl-LWP-Protocol-httpstumbleweed6.06-1.4fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianliblwp-protocol-https-perlsourcesid6.04-3not yet assignedNot reported[746579]
Debianliblwp-protocol-https-perlsourceforky6.04-3not yet assignedNot reported[746579]
Debianliblwp-protocol-https-perlsourcetrixie6.04-3not yet assignedNot reported[746579]
Debianliblwp-protocol-https-perlsourcebookworm6.04-3not yet assignedNot reported[746579]
Alpineperl-lwp-protocol-httpsapk3.196.11-r0Not reportedALPINE-CVE-2014-3230Not reported
Alpineperl-lwp-protocol-httpsapk3.206.11-r0Not reportedALPINE-CVE-2014-3230Not reported
Alpineperl-lwp-protocol-httpsapk3.216.11-r0Not reportedALPINE-CVE-2014-3230Not reported
Alpineperl-lwp-protocol-httpsapk3.226.11-r0Not reportedALPINE-CVE-2014-3230Not reported
Alpineperl-lwp-protocol-httpsapk3.236.11-r0Not reportedALPINE-CVE-2014-3230Not reported
Alpineperl-lwp-protocol-httpsapk3.246.11-r0Not reportedALPINE-CVE-2014-3230Not reported
Ubuntuliblwp-protocol-https-perldeb14.046.04-2ubuntu0.1Not reportedUSN-2292-1Not reported
Ubuntuliblwp-protocol-https-perldeb14.046.04-2ubuntu0.1Not reportedUBUNTU-CVE-2014-3230Not reported
Opensuseperl-LWP-Protocol-httpsrpmtumbleweed6.06-1.4Not reportedOPENSUSE-SU-2024:10239-1Not reported

[Debian bug #746579]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [liblwp-protocol-https-perl]Fixed
    Details (2)

    • 6.10-1 · all · bookworm

      Fixed · Fixed: 6.04-3

      dsa · liblwp-protocol-https-perl · debian · bookworm; dsa · liblwp-protocol-https-perl · debian · 12

    • 6.10-1 · all · bookworm

      Fixed · Fixed: 6.04-3

      dsa · liblwp-protocol-https-perl · debian · bookworm; dsa · liblwp-protocol-https-perl · debian · 12

[Debian 13 (Trixie)]

  • [liblwp-protocol-https-perl]Fixed
    Details (2)

    • 6.14-1 · all · trixie

      Fixed · Fixed: 6.04-3

      dsa · liblwp-protocol-https-perl · debian · 13

    • 6.14-1 · all · trixie

      Fixed · Fixed: 6.04-3

      dsa · liblwp-protocol-https-perl · debian · 13

[openSUSE Tumbleweed]

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]