CVE-2007-5034

2007-09-2100:00:00

ubuntu.com

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.009 Low

EPSS

Percentile

82.3%

JSON

ELinks before 0.11.3, when sending a POST request for an https URL, appends
the body and content headers of the POST request to the CONNECT request in
cleartext, which allows remote attackers to sniff sensitive data that would
have been protected by TLS. NOTE: this issue only occurs when a proxy is
defined for https.

Notes

Author	Note
jdstrand	0.11.3 and higher not vulnerable

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchelinks< 0.10.6-1ubuntu3.2UNKNOWN
ubuntu6.10noarchelinks< 0.11.1-1ubuntu2.2UNKNOWN
ubuntu7.04noarchelinks< 0.11.1-1.2ubuntu2.2UNKNOWN