[ GLSA 201101-06 ] IO::Socket::SSL: Certificate validation error

[GLSA]

Gentoo Linux Security Advisory

Title: IO::Socket::SSL: Certificate validation error (GLSA 201101-06)
Severity: normal
Exploitable: remote
Date: January 16, 2011
Bug(s): #276360
ID: 201101-06

Synopsis


An error in the hostname matching of IO::Socket::SSL might enable remote
attackers to conduct man-in-the-middle attacks.


Background


IO::Socket::SSL is a Perl class implementing an object oriented
interface to SSL sockets.


Affected Packages

Package: dev-perl/IO-Socket-SSL
Vulnerable: < 1.26
Unaffected: >= 1.26
Architectures: All supported architectures


Description


The vendor reported that IO::Socket::SSL does not properly handle
Common Name (CN) fields.


Impact


A remote attacker might employ a specially crafted certificate to
conduct man-in-the-middle attacks on SSL connections made using
IO::Socket::SSL.


Workaround


There is no known workaround at this time.


Resolution


All IO::Socket::SSL users should upgrade to the latest version: