gisle/libwww-perl — pull request #22 by madsen (2011-10-11 20:06:39+00:00)
Title: verify_hostname defaults to 0 if ssl_opts provided (RT#67947)

This fixes [RT#67947](https://rt.cpan.org/Public/Bug/Display.html?id=67947), which I consider a serious security hole. There's an easy workaround (specify `verify_hostname` in your `ssl_opts` hash), but what makes it serious is that it's so easy to miss the fact that your app is not verifying the hostname. Unless you actually test your app against a server that presents the wrong certificate, you might never notice the huge security hole you've left open.

I also added some tests to make sure it works.