CVE-2010-4334 The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote att...
MediumCVSS 4.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| io-socket-ssl | = 1.35 | No fix listed |
| debian/libio-socket-ssl-perl(Debian:12) | < 1.35-1 | 1.35-1 |
| debian/libio-socket-ssl-perl(Debian:13) | < 1.35-1 | 1.35-1 |
| debian/libio-socket-ssl-perl(Debian:14) | < 1.35-1 | 1.35-1 |
References
- bugs.debian.org patch
- cpansearch.perl.org
- FEDORA-2010-19054 vendor-advisory
- FEDORA-2010-19058 vendor-advisory
- 69626 vdb-entry
- 42508 third-party-advisory vendor-advisory
- 42757 third-party-advisory
- MDVSA-2011:092 vendor-advisory
- [oss-security] 20101209 Re: CVE requests: IO::Socket::SSL, cakephp, collectd, gnash, ocrodjvu, hypermail, libcloud, piwigo mailing-list
- [oss-security] 20101224 IO::Socket::SSL perl module: CVE-2010-4501/CVE-2010-4334 dupe mailing-list
- 45189 vdb-entry
- Debian Security Tracker CVE-2010-4334 vendor-advisory
- bugs.debian.org issue-tracking