CVE-2017-10789

Priority
Low
Description
The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting
to mean that SSL is optional (even though this setting's documentation has
a "your communication with the server will be encrypted" statement), which
allows man-in-the-middle attackers to spoof servers via a
cleartext-downgrade attack, a related issue to CVE-2015-3152.
References
Bugs
Package
Upstream:needs-triage
Ubuntu 17.10 (Artful Aardvark):needed
Ubuntu 12.04 ESM (Precise Pangolin):needed
Ubuntu 14.04 LTS (Trusty Tahr):needed
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):needed
Ubuntu 17.04 (Zesty Zapus):needed
More Information

Updated: 2017-08-18 15:14:14 UTC (commit 13137)