The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.
Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
| Link | Tags |
|---|---|
| http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes | |
| http://www.vupen.com/english/advisories/2011/0118 | vdb entry |
| http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml | vendor advisory |
| http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html | vendor advisory |
| http://secunia.com/advisories/42893 | third party advisory |
| http://www.openwall.com/lists/oss-security/2009/08/28/1 | mailing list |
| http://www.openwall.com/lists/oss-security/2009/08/29/1 | mailing list |
| http://www.openwall.com/lists/oss-security/2009/08/31/4 | mailing list |