NVD

Id
50241  
Name
CVE-2009-3024  
Description
The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-08-31  
Modified Date
2011-01-20  
Seq
2009-3024  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
254303 50241 CVE-2009-3024 http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes  View
254304 50241 CVE-2009-3024 SUSE-SR:2009:015  View
254305 50241 CVE-2009-3024 GLSA-201101-06  View
254306 50241 CVE-2009-3024 [oss-security] 20090828 CVE request: perl-IO-Socket-SSL certificate hostname compare bug  View
254307 50241 CVE-2009-3024 [oss-security] 20090829 Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug  View
254308 50241 CVE-2009-3024 [oss-security] 20090831 Re: Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug  View
254309 50241 CVE-2009-3024 ADV-2011-0118  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
43901 JVNDB-2009-004908 IO-Socket-SSL の証明書チェック機能における証明書のホスト名チェックを回避される脆弱性 IO-Socket-SSL (IO::Socket::SSL) の証明書チェック機能の verify_hostname_of_cert 関数は、ワイルドカードが使用されていない際、ホスト名の接頭語のみを照合するため、証明書のホスト名チェックを回避される脆弱性が存在します。 CVE-2009-3024 40455 CVE-2009-3024 50241 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004908.html 2009-08-31 2012-09-25 View