| Package | Affected versions | Patched versions |
|---|---|---|
| io-socket-ssl | = 1.14= 1.15= 1.16= 1.16_1= 1.16_2= 1.16_3= 1.17= 1.18= 1.19= 1.20= 1.21= 1.22= 1.23= 1.24= 1.25 |
The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free