CVE-2017-10789

The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.

References

Affected packages

Git / github.com/perl5-dbi/dbd-mysql

Affected ranges

Type

GIT

Repo

https://github.com/perl5-dbi/dbd-mysql

Events

Introduced

Last affected

6fd72e55c9771b25b5775d08a120baae3181806e

Database specific

{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "4.043"
        }
    ],
    "cpe": "cpe:2.3:a:dbd-mysql_project:dbd-mysql:*:*:*:*:*:*:*:*"
}

Affected versions

4.*

4.030_01

4.030_02

4.031

4.032

4.032_01

4.032_02

4.032_03

4.033

4.033_01

4.033_02

4.033_03

4.034

4.035

4.035_01

4.035_02

4.035_03

4.036

4.037

4.037_01

4.037_02

4.038

4.038_01

4.040

4.041

4.041_01

4.041_2

4.042

4.043

Other

4_012

4_013

4_014

4_015

4_019

4_020

4_022

4_022_1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-10789.json"