CVE

Id
40459  
CVE No.
CVE-2009-3024  
Status
Candidate  
Description
The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.  
Phase
Assigned (20090831)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
444477 40459 CVE-2009-3024 MLIST:[oss-security] 20090828 CVE request: perl-IO-Socket-SSL certificate hostname compare bug  View
444478 40459 CVE-2009-3024 URL:http://www.openwall.com/lists/oss-security/2009/08/28/1  View
444479 40459 CVE-2009-3024 MLIST:[oss-security] 20090829 Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug  View
444480 40459 CVE-2009-3024 URL:http://www.openwall.com/lists/oss-security/2009/08/29/1  View
444481 40459 CVE-2009-3024 MLIST:[oss-security] 20090831 Re: Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug  View
444482 40459 CVE-2009-3024 URL:http://www.openwall.com/lists/oss-security/2009/08/31/4  View
444483 40459 CVE-2009-3024 CONFIRM:http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes  View
444484 40459 CVE-2009-3024 GENTOO:GLSA-201101-06  View
444485 40459 CVE-2009-3024 URL:http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml  View
444486 40459 CVE-2009-3024 SUSE:SUSE-SR:2009:015  View
444487 40459 CVE-2009-3024 URL:http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html  View
444488 40459 CVE-2009-3024 SECUNIA:42893  View
444489 40459 CVE-2009-3024 URL:http://secunia.com/advisories/42893  View
444490 40459 CVE-2009-3024 VUPEN:ADV-2011-0118  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
41695 JVNDB-2009-002702 Symantec Altiris Deployment Solution などの製品で使用される Altiris eXpress NS SC Download ActiveX コントロールにおける任意のファイルをダウンロードされる脆弱性 Symantec Altiris Deployment Solution、Notification Server および Symantec Management Platformで使用されている AeXNSPkgDLLib.dll の Altiris eXpress NS SC Download ActiveX コントロールは、安全でないメソッドが存在するため、任意のファイルをダウンロードされる、および任意のコードを実行される脆弱性が存在します。 CVE-2009-3028 40459 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002702.html  View