GLSA-201101-06 : IO::Socket::SSL: Certificate validation error
Medium Nessus Plugin ID 51536
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-201101-06 (IO::Socket::SSL: Certificate validation error)
The vendor reported that IO::Socket::SSL does not properly handle Common Name (CN) fields.
A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using IO::Socket::SSL.
There is no known workaround at this time.
SolutionAll IO::Socket::SSL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=dev-perl/IO-Socket-SSL-1.26'