[ MDVSA-2009:178 ] perl-IO-Socket-SSL

[dude67]

_______________________________________________________________________

Package : perl-IO-Socket-SSL
Date : September 30, 2009
Affected: 2009.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in perl-IO-Socket-SSL:

The verify_hostname_of_cert function in the certificate checking
feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only
matches the prefix of a hostname when no wildcard is used, which
allows remote attackers to bypass the hostname check for a certificate
(CVE-2009-3024).

This update provides a fix for this vulnerability.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3024
_______________________________________________________________________