|
|
| |
|
| |
perl-IO-Socket-SSL: denial of service
| Package(s): | perl-IO-Socket-SSL |
CVE #(s): | CVE-2010-4334
|
| Created: | December 27, 2010 |
Updated: | May 18, 2011 |
| Description: |
From the Red Hat bugzilla:
A Debian bug report indicated that using the IO::Socket::SSL perl module,
if the verify_mode were set to 0x03 (verify peer, fail verification if no peer certificate exists), that the requests were removed unless either the ca_file or ca_path were supplied. This means that IO::Socket::SSL "fails open" if the user forgets to supply information about an acceptable set of trusted CAs, rather than "failing closed" (denying access by default, rather than allowing it).
|
| Alerts: |
|
( Log in to post comments)
|
|
|