[ MDVSA-2009:252-1 ] perl-IO-Socket-SSL

[dude67]

_______________________________________________________________________

Package : perl-IO-Socket-SSL
Date : December 5, 2009
Affected: 2009.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in perl-IO-Socket-SSL:

The verify_hostname_of_cert function in the certificate checking
feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only
matches the prefix of a hostname when no wildcard is used, which
allows remote attackers to bypass the hostname check for a certificate
(CVE-2009-3024).

This update provides a fix for this vulnerability.

Update:

Packages were missing for 2009.0, this update addresses the problem.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-3024
_______________________________________________________________________