| Name | CVE-2017-10789 |
| Description | The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-1079-1 |
| Debian Bugs | 866821 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libdbd-mysql-perl (PTS) | bullseye | 4.050-3 | fixed |
| bookworm | 4.050-5 | fixed |
| sid, trixie | 4.052-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[stretch] - libdbd-mysql-perl <no-dsa> (Minor issue, can be fixed via point release)
[jessie] - libdbd-mysql-perl <no-dsa> (Minor issue, can be fixed via point release)
https://github.com/perl5-dbi/DBD-mysql/issues/110
https://github.com/perl5-dbi/DBD-mysql/pull/114
Upstream 4.042 fixed this issue, but was reverted upstream in 4.043:
https://www.nntp.perl.org/group/perl.dbi.dev/2017/08/msg8037.html
No upstream-blessed patch available.