The DBD::mysql module through 4.043 for Perl uses the mysql_ssl=1 setting to mean that SSL is optional (even though this setting's documentation has a \your communication with the server will be encrypted\ statement) which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack a related issue to CVE-2015-3152.