CVE-2009-3024

Name	CVE-2009-3024
Description	The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libio-socket-ssl-perl (PTS)	jessie	2.002-2+deb8u3	fixed
	stretch	2.044-1	fixed
	buster	2.060-3	fixed
	bullseye	2.069-1	fixed
	bookworm	2.081-2	fixed
	sid, trixie	2.089-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
libio-socket-ssl-perl	source	etch	(not affected)
libio-socket-ssl-perl	source	lenny	1.16-1+lenny1
libio-socket-ssl-perl	source	(unstable)	1.30-1

[etch] - libio-socket-ssl-perl <not-affected> (Affected functionality introduced in 1.14)