CVE-2007-5034

ELinks before 0.11.3, when sending a POST request for an https URL, appends the body and content headers of the POST request to the CONNECT request in cleartext, which allows remote attackers to sniff sensitive data that would have been protected by TLS. NOTE: this issue only occurs when a proxy is defined for https.

Link	Resource
http://bugzilla.elinks.cz/show_bug.cgi?id=937
https://bugs.launchpad.net/ubuntu/+source/elinks/+bug/141018
https://bugzilla.redhat.com/show_bug.cgi?id=297981
http://www.debian.org/security/2007/dsa-1380
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00335.html
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00079.html
http://www.redhat.com/support/errata/RHSA-2007-0933.html
http://www.ubuntu.com/usn/usn-519-1
http://www.securityfocus.com/bid/25799
http://www.securitytracker.com/id?1018764
http://secunia.com/advisories/26936
http://secunia.com/advisories/26956
http://secunia.com/advisories/26949
http://secunia.com/advisories/27062
http://secunia.com/advisories/27125
http://secunia.com/advisories/27132
http://secunia.com/advisories/27038
http://www.vupen.com/english/advisories/2007/3278
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10335
http://www.securityfocus.com/archive/1/481606/100/0/threaded

Configuration 1

cpe:2.3:a:elinks:elinks:*:*:*:*:*:*:*:* cpe:2.3:a:elinks:elinks:*:*:*:*:*:*:*:*

---

Published : 2007-09-21 08:17

Updated : 2018-10-15 09:40

---

NVD link : CVE-2007-5034

Mitre link : CVE-2007-5034

No products.

CWE-200