Stay Secure with the Latest Linux Advisories

security advisoryinformation exposureubuntu

Ubuntu 14.04 LTS USN-2292-1 Moderate: LWP Protocol HTTPS Data Exposure

LWP::Protocol::https could be made to expose sensitive information over the network.. =========================================================================Ubuntu Security Notice USN-2292-1 July 17, 2014 liblwp-protocol-https-perl vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 14.04 LTS Summary: LWP::Protocol::https could be made to expose sensitive information over the network. Software Description: - liblwp-protocol-https-perl: HTTPS driver for LWP::UserAgent Details: It was discovered that the LWP::Protocol::https perl module incorrectly disabled peer certificate verification completely when only hostname verification was requested to be disabled. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could possibly be exploited in certain scenarios to alter or compromise confidential information in applications that used the LWP::Protocol::https module. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 14.04 LTS: liblwp-protocol-https-perl 6.04-2ubuntu0.1 In general, a standard system update will make all the necessary changes. References: https://ubuntu.com/security/notices/USN-2292-1 CVE-2014-3230 Package Information: https://launchpad.net/ubuntu/+source/liblwp-protocol-https-perl/6.04-2ubuntu0.1 . Ubuntu Security Notice USN-2293-2 identifies a vulnerability in LWP::Protocol::http that could potentially leak confidential information during transmission.. LWP Protocol, Information Exposure, Man-in-the-Middle, Ubuntu Update, Security Notice. . LinuxSecurity.com Team

Jul 17, 2014 Ubuntu