/ 
IO-Socket-SSL-1.30_3
River stage four • 359 direct dependents • 2094 total dependents
Security Advisories (2)
CVE-2010-4334 (2011-01-14)

The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.

CVE-2009-3024 (2009-08-31)

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

Changes for version v1.30_3

  • make t/memleak_bad_handshake.t more stable (increase listen queue, ignore errors on connect, don't run on windows..)

Changes for version v1.30_2

  • t/memleak_bad_handshake.t don't write errors with ps to stderr, -o vsize argument is not supported on all platforms, just skip test then

Changes for version v1.30_1

  • make sure that idn_to_ascii gets no \0 bytes from identity, because it simply cuts the string their (using C semantics). Not really a security problem because IDN like identity is provided by user in hostname, not by certificate.

Modules

IO::Socket::SSL
Nearly transparent SSL encapsulation for IO::Socket::INET.

Provides

IO::Socket::SSL::SSL_Context
in SSL.pm
IO::Socket::SSL::SSL_HANDLE
in SSL.pm
IO::Socket::SSL::Session_Cache
in SSL.pm

Examples

Other files