CVE-2010-4334

Name	CVE-2010-4334
Description	The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	606058

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libio-socket-ssl-perl (PTS)	jessie	2.002-2+deb8u3	fixed
	stretch	2.044-1	fixed
	buster	2.060-3	fixed
	bullseye	2.069-1	fixed
	bookworm	2.081-2	fixed
	sid, trixie	2.089-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
libio-socket-ssl-perl	source	lenny	(not affected)
libio-socket-ssl-perl	source	squeeze	1.33-1+squeeze1
libio-socket-ssl-perl	source	(unstable)	1.35-1	606058

[lenny] - libio-socket-ssl-perl <not-affected> (Vulnerable code not present)