CVE-2010-4334

Publication date 14 January 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.

Read the notes from the security team

Status

Package Ubuntu Release Status
libio-socket-ssl-perl 13.10 saucy
Not affected
13.04 raring
Not affected
12.10 quantal
Not affected
12.04 LTS precise
Not affected
11.10 oneiric
Not affected
11.04 natty
Not affected
10.10 maverick Ignored end of life
10.04 LTS lucid Ignored end of life
9.10 karmic Ignored end of life
8.04 LTS hardy
Not affected
6.06 LTS dapper Ignored end of life

Notes

mdeslaur

This was _fixed_ in 1.35, and introduced in 1.23 karmic and later is in universe