CVE-2017-10789: Medium severity dbd-mysql vulnerability
Last updated 7 April 2025
Other sources
The DBD::mysql module through 4.043 for Perl uses the mysqlssl=1 setting to mean that SSL is optional (even though this setting's documentation has a "your communication with the server will be encrypted" statement), which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-10789?
CVE-2017-10789 has a severity rating that indicates a significant risk of man-in-the-middle attacks due to improper handling of SSL settings.
How do I fix CVE-2017-10789?
To fix CVE-2017-10789, upgrade the DBD::mysql module to version 4.044 or higher where this vulnerability is addressed.
What systems are affected by CVE-2017-10789?
CVE-2017-10789 affects versions of the DBD::mysql module through 4.043 for Perl.
What type of attack does CVE-2017-10789 allow?
CVE-2017-10789 allows man-in-the-middle attackers to potentially spoof servers by exploiting the SSL optionality.
Is SSL encryption mandatory with CVE-2017-10789?
No, due to the vulnerability in CVE-2017-10789, the mysql_ssl=1 setting incorrectly allows SSL to be optional.