Remote Code Execution Risk in IO::Socket::SSL Module for Perl by CPAN
CVE-2010-4334

Currently unrated

Key Information:

Vendor: Io-socket-ssl
Status: Io-socket-ssl
Vendor: CVE Published:; 14 January 2011

🔔 Create Io-socket-ssl Vulnerability Alert

What is CVE-2010-4334?

The IO::Socket::SSL module version 1.35 in Perl contains a significant flaw in its certificate verification process. When the verify_mode is set to a value other than VERIFY_NONE, the module improperly defaults to VERIFY_NONE if the specified ca_file or ca_path cannot be verified. This behavior allows potential attackers to circumvent intended certificate restrictions, posing a serious risk of remote code execution. This vulnerability underscores the importance of robust SSL/TLS implementations to maintain security and integrity in communications.

References

http://secunia.com/advisories/42757

third-party-advisoryx_refsource_SECUNIA

http://lists.fedoraproject.org/pipermail/package-announce...

vendor-advisoryx_refsource_FEDORA

http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.35/C...

x_refsource_CONFIRM

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 14, 2011
Vulnerability Reserved
Nov 30, 2010

CVE-2010-4334 Data

JSON