Description
The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6Attack Vector: Network
Complexity: High
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None
Affected Packages1 packages
🔴Vulnerability Details
5OSVlibdbd-mysql-perl vulnerabilities↗2025-04-07 GHSAGHSA-4384-9v4p-2vmf: The DBD::mysql module through 4↗2022-05-13 OSVlibdbd-mysql-perl vulnerabilities↗2022-04-01 CVEListCVE-2017-10789: The DBD::mysql module through 4↗2017-07-01 OSVCVE-2017-10789: The DBD::mysql module through 4↗2017-07-01 📋Vendor Advisories
4Ubuntulibdbd-mysql-perl vulnerabilities↗2025-04-07 UbuntuDBD::mysql vulnerabilities↗2022-04-01 Red Hatperl-DBD-MySQL: Possible MITM attack when mysql_ssl=1↗2017-07-01 DebianCVE-2017-10789: libdbd-mysql-perl - The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mea...↗2017 💬Community
2BugzillaCVE-2017-10789 perl-DBD-MySQL: Possible MITM attack when mysql_ssl=1↗2017-07-04 BugzillaCVE-2017-10788 CVE-2017-10789 perl-DBD-MySQL: various flaws [fedora-all]↗2017-07-04