CVE-2007-5034: Infoleak
First published: Fri Sep 21 2007(Updated: )
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
Credit: security@ubuntu.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Elinks Elinks | <=0.11.1 | |
| Elinks Elinks | <=0.11.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://bugzilla.elinks.cz/show_bug.cgi?id=937
- https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018
- https://bugzilla.redhat.com/show_bug.cgi?id=297981
- http://www.debian.org/security/2007/dsa-1380
- https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html
- https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html
- http://www.redhat.com/support/errata/RHSA-2007-0933.html
- http://www.ubuntu.com/usn/usn-519-1
- http://www.securityfocus.com/bid/25799
- http://www.securitytracker.com/id?1018764
- http://secunia.com/advisories/26936
- http://secunia.com/advisories/26956
- http://secunia.com/advisories/26949
- http://secunia.com/advisories/27062
- http://secunia.com/advisories/27125
- http://secunia.com/advisories/27132
- http://secunia.com/advisories/27038
- http://www.vupen.com/english/advisories/2007/3278
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335
- http://www.securityfocus.com/archive/1/481606/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- vendor/elinks
- canonical/elinks elinks
- version/elinks elinks/0.11.1
- version/elinks elinks/0.11.2