Bug 386309 – <dev-perl/libwww-perl-6.30.0: MITM vulnerability (CVE-2011-0633)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2011-10-08 14:00:22 UTC]

CVE-2011-0633 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0633):
  The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in
  WWW::Mechanize, LWP::UserAgent, and other products, when running in
  environments that do not set the If-SSL-Cert-Subject header, does not enable
  full validation of SSL certificates by default, which allows remote
  attackers to spoof servers via man-in-the-middle (MITM) attacks involving
  hostnames that are not properly validated.  NOTE: it could be argued that
  this is a design limitation of the Net::HTTPS API, and separate
  implementations should be independently assigned CVE identifiers for not
  working around this limitation. However, because this API was modified
  within LWP, a single CVE identifier has been assigned.

[Comment 1 Torsten Veller (RETIRED) 2011-11-05 09:38:28 UTC]

Please stabilize

=dev-perl/libwww-perl-6.30.0
=dev-perl/HTTP-Negotiate-6.0.0
=dev-perl/LWP-Protocol-https-6.20.0
=dev-perl/HTTP-Date-6.0.0
=dev-perl/File-Listing-6.30.0
=dev-perl/WWW-RobotRules-6.10.0
=dev-perl/Net-HTTP-6.10.0
=dev-perl/LWP-MediaTypes-6.10.0
=dev-perl/Encode-Locale-1.20.0
=dev-perl/HTTP-Message-6.20.0
=dev-perl/HTTP-Cookies-6.0.0
=dev-perl/HTTP-Daemon-6.0.0
=dev-perl/IO-Socket-SSL-1.440.0
=dev-perl/HTML-Form-6.0.0

[Comment 2 Agostino Sarubbo 2011-11-05 09:44:20 UTC]

all fine on amd64.

[Comment 3 Myckel Habets 2011-11-05 18:05:48 UTC]

Builds fine on x86. Please mark stable for x86.

[Comment 4 Brent Baude (RETIRED) 2011-11-06 13:16:14 UTC]

ppc done

[Comment 5 Andreas Schürch 2011-11-06 14:09:50 UTC]

x86 done, thanks Myckel!

[Comment 6 Ian Delaney (RETIRED) 2011-11-06 17:54:39 UTC]

amd64:

all ok

[Comment 7 Markus Meier 2011-11-06 22:06:11 UTC]

arm stable

[Comment 8 Jeroen Roovers (RETIRED) 2011-11-07 13:14:39 UTC]

Stable for HPPA.

[Comment 9 Tony Vroon (RETIRED) 2011-11-08 23:30:30 UTC]

+  08 Nov 2011; Tony Vroon <[e-mail]> HTTP-Date-6.0.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> Encode-Locale-1.20.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> LWP-MediaTypes-6.10.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> HTTP-Message-6.20.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> HTTP-Negotiate-6.0.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> File-Listing-6.30.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> HTTP-Cookies-6.0.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> HTTP-Daemon-6.0.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> WWW-RobotRules-6.10.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> Net-HTTP-6.10.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> IO-Socket-SSL-1.440.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]>
+  LWP-Protocol-https-6.20.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

+  08 Nov 2011; Tony Vroon <[e-mail]> libwww-perl-6.30.0.ebuild:
+  Marked stable on AMD64 based on arch testing by Agostino "ago" Sarubbo & Ian
+  "idella4" Delaney in security bug #386309.

Consideration of dependency order would be appreciated in future bugs, particularly with stabilisation lists of this length.

[Comment 10 Raúl Porcel (RETIRED) 2011-11-19 19:59:18 UTC]

alpha/ia64/m68k/s390/sh/sparc stable

[Comment 11 Mark Loeser (RETIRED) 2011-12-18 21:37:24 UTC]

ppc64 done

[Comment 12 Tim Sammut (RETIRED) 2011-12-18 21:51:17 UTC]

Thanks, folks. GLSA Vote: yes.

[Comment 13 Stefan Behte (RETIRED) 2012-03-06 01:04:52 UTC]

Vote: Yes. GLSA request filed.

[Comment 14 GLSAMaker/CVETool Bot 2014-02-04 16:33:10 UTC]

This issue was resolved and addressed in
 GLSA 201402-04 at http://security.gentoo.org/glsa/glsa-201402-04.xml
by GLSA coordinator Mikle Kolyada (Zlogene).