Cpanel security update to perl - LWP ssl problem

[sloop]

I have had two client's servers exhibit the same problem recently.

Both servers were set to manual whm/cpanel updates, only automatic security updates.

A change in perl modules sometime after April 10 broke some perl scripts that make HTTPS requests. One of them was making requests to ebay, the other to authorize.net.

One of the servers had a clickcart pro shopping cart on it (perl) and was showing this error when trying to contact authorize.net via https:

Script execution error

Server closed connection without sending any data back

The other test perl script from ebay was showing

SSL3_GET_RECORD:wrong version number

The fix was to restore /usr/lib/perl5/site_perl from an earlier backup, or point the perl script to use an older perl interpreter installed on the system.

Has anyone else seen this problem? It seems to be pretty significant but I haven't had any luck in tracking down the exact cause. I think this is the file in question that was updated causing the problem:

/usr/lib/perl5/site_perl/5.8.8/LWP/Protocol/http.pm

I tried manipulating LWP by manually setting $ENV{HTTPS_VERSION} to SSLv2 and then SSLv3 but that didnt help.

 

[sloop]

for anyone else who stumbles upon this

The problem was acknowledged in the libwww-perl package which includes LWP::Request

Changelog: http://search.cpan.org/src/GAAS/libwww-perl-5.812/Changes

For releast 5.812 that just came out today, they acknowledged and apparently fixed the problem:

5.811 breaks SSL requests [RT#35090]

 

[webstro]

Fix LWP SSL problem

Thanks for the input. We have been struggling with this all afternoon. These are the steps that we took to upgrade to working version of LWP:

# wget http://cpan.uwinnipeg.ca/cpan/authors/id/G/GA/GAAS/libwww-perl-5.812.tar.gz

# tar xzf libwww-perl-5.812.tar.gz

# cd libwww-perl-5.812

# perl Makefile.PL

// answer yes to all

# make

# make test

# make install

After that no more script failure.