/ 
IO-Socket-SSL-2.055
River stage four • 359 direct dependents • 2094 total dependents
⭐ Starred 37 GitHub stars
Security Advisories (1)
CVE-2009-3024 (2009-08-31)

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

Changes for version 2.055 - 2018-02-15

  • use SNI also if hostname was given all-uppercase
  • Utils::CERT_create - don't add authority key for issuer since Chrome does not like this
  • Intercept:
    • change behavior of code based cache to better support synchronizing within multiprocess/threaded setups
    • don't use counter for serial number but somehow base it on original certificate in order to avoid conflicts with reuse of serial numbers after restart
  • RT#124431 - better support platforms w/o IPv6
  • RT#124306 - spelling fixes in documentation

Modules

IO::Socket::SSL
SSL sockets with IO::Socket interface
IO::Socket::SSL::Intercept
SSL interception (man in the middle)
IO::Socket::SSL::PublicSuffix
provide access to Mozilla's list of effective TLD names
IO::Socket::SSL::Utils
loading, storing, creating certificates and keys

Provides

IO::Socket::SSL::OCSP_Cache
in lib/IO/Socket/SSL.pm
IO::Socket::SSL::OCSP_Resolver
in lib/IO/Socket/SSL.pm
IO::Socket::SSL::SSL_Context
in lib/IO/Socket/SSL.pm
IO::Socket::SSL::SSL_HANDLE
in lib/IO/Socket/SSL.pm
IO::Socket::SSL::Session_Cache
in lib/IO/Socket/SSL.pm

Examples

Other files