DEBIAN-CVE-2009-3024

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2009-3024
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3024.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2009-3024
Upstream
Published
2009-08-31T20:30:01Z
Modified
2026-09-17T06:47:41Z
Summary
[none]
Details

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

References

Affected packages

Debian:12 / libio-socket-ssl-perl

Package

Name
libio-socket-ssl-perl
Purl
pkg:deb/debian/libio-socket-ssl-perl?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3024.json"

Debian:13 / libio-socket-ssl-perl

Package

Name
libio-socket-ssl-perl
Purl
pkg:deb/debian/libio-socket-ssl-perl?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3024.json"

Debian:14 / libio-socket-ssl-perl

Package

Name
libio-socket-ssl-perl
Purl
pkg:deb/debian/libio-socket-ssl-perl?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.30-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2009-3024.json"