Hostname Matching Flaw in IO-Socket-SSL Versions 1.14-1.25
CVE-2009-3024

Currently unrated

Key Information:

Vendor: Io-socket-ssl
Status: Io-socket-ssl
Vendor: CVE Published:; 31 August 2009

🔔 Create Io-socket-ssl Vulnerability Alert

What is CVE-2009-3024?

The 'verify_hostname_of_cert' function in IO-Socket-SSL versions 1.14 to 1.25 allows for the hostname check of a certificate to be bypassed by matching only the prefix of the hostname unless a wildcard is employed. This behavior can be exploited by remote attackers to present a different hostname for a given SSL certificate, potentially compromising the security of the connection.

References

http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/C...

x_refsource_CONFIRM

http://www.vupen.com/english/advisories/2011/0118

vdb-entryx_refsource_VUPEN

http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml

vendor-advisoryx_refsource_GENTOO

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Aug 31, 2009
Vulnerability Reserved
Aug 31, 2009

CVE-2009-3024 Data

JSON