CVE-2014-3230

Name of the Vulnerable Software and Affected Versions libwww-perl LWP::Protocol::https module versions 6.04 through 6.06

Description The issue allows attackers to disable server certificate validation via the HTTPS CA DIR or HTTPS CA FILE environment variable when using IO::Socket::SSL as the SSL socket class.

Recommendations For versions 6.04 through 6.06, consider disabling the use of the HTTPS CA DIR and HTTPS CA FILE environment variables to prevent server certificate validation from being disabled until a patch is available. Restrict access to the environment variables to minimize the risk of exploitation.