ext/mysqlnd/mysqlnd.c in PHP before 5.4.43 5.5.x before 5.5.27 and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack a related issue to CVE-2015-3152.