CVE - CVE-2007-5034

CVE-ID
CVE-2007-5034	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:25799 URL:http://www.securityfocus.com/bid/25799 BUGTRAQ:20071005 rPSA-2007-0209-1 elinks URL:http://www.securityfocus.com/archive/1/481606/100/0/threaded CONFIRM:http://bugzilla.elinks.cz/show_bug.cgi?id=937 CONFIRM:https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=297981 DEBIAN:DSA-1380 URL:http://www.debian.org/security/2007/dsa-1380 FEDORA:FEDORA-2007-2224 URL:https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html FEDORA:FEDORA-2007-710 URL:https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html OVAL:oval:org.mitre.oval:def:10335 URL:https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335 REDHAT:RHSA-2007:0933 URL:http://www.redhat.com/support/errata/RHSA-2007-0933.html SECTRACK:1018764 URL:http://www.securitytracker.com/id?1018764 SECUNIA:26936 URL:http://secunia.com/advisories/26936 SECUNIA:26949 URL:http://secunia.com/advisories/26949 SECUNIA:26956 URL:http://secunia.com/advisories/26956 SECUNIA:27038 URL:http://secunia.com/advisories/27038 SECUNIA:27062 URL:http://secunia.com/advisories/27062 SECUNIA:27125 URL:http://secunia.com/advisories/27125 SECUNIA:27132 URL:http://secunia.com/advisories/27132 UBUNTU:USN-519-1 URL:http://www.ubuntu.com/usn/usn-519-1 VUPEN:ADV-2007-3278 URL:~~http://www.vupen.com/english/advisories/2007/3278~~ (Obsolete source)
Assigning CNA
Canonical Ltd.
Date Record Created
20070921	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20070921)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)