MDVSA-2011:092 -- Mandriva perl-IO-Socket-SSL| ID: oval:org.secpod.oval:def:301021 | Date: (C)2012-01-07 (M)2021-09-30 |
| Class: PATCH | Family: unix |
A vulnerability has been found and corrected in perl-IO-Socket-SSL: IO::Socket::SSL Perl module 1.35, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions . The updated packages have been patched to correct this issue.
| Platform: |
| Mandriva Linux 2010.1 |
| Product: |
| perl-IO-Socket-SSL |
