NVD

Id
15589  
Name
CVE-2010-4334  
Description
The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.  
Reject
 
CVSS Version
2  
CVSS Score
4  
Severity
Medium  
CVSS Base Score
4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
4.9  
CVSS Vector
(AV:N/AC:H/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-18  
Published
2011-01-13  
Modified Date
2011-10-13  
Seq
2010-4334  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
88221 15589 CVE-2010-4334 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058  View
88222 15589 CVE-2010-4334 http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.35/Changes  View
88223 15589 CVE-2010-4334 FEDORA-2010-19054  View
88224 15589 CVE-2010-4334 FEDORA-2010-19058  View
88225 15589 CVE-2010-4334 MDVSA-2011:092  View
88226 15589 CVE-2010-4334 [oss-security] 20101209 Re: CVE requests: IO::Socket::SSL, cakephp, collectd, gnash, ocrodjvu, hypermail, libcloud, piwigo  View
88227 15589 CVE-2010-4334 [oss-security] 20101224 IO::Socket::SSL perl module: CVE-2010-4501/CVE-2010-4334 dupe  View
88228 15589 CVE-2010-4334 45189  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
33660 JVNDB-2011-003902 IO::Socket::SSL モジュールにおける証明書の制限を回避される脆弱性 IO::Socket::SSL モジュールは、verify_mode が VERIFY_NONE でない際、ca_file/ca_path が検証できないエラーを出す代わりに VERIFY_NONE のオープンに失敗するため、証明書の制限を回避される脆弱性が存在します。 CVE-2010-4334 46914 CVE-2010-4334 15589 4 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-003902.html 2011-01-13 2012-03-27 View