Lucene search

[email protected]CVE-2009-3942

HistoryNov 16, 2009 - 7:30 p.m.

CVE-2009-3942

2009-11-1619:30:01

CWE-310

[email protected]

web.nvd.nist.gov

msmtp

openssl

ssl server spoofing

cve-2009-3942

nvd

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

AI Score

Confidence

High

EPSS

0.003

Percentile

65.2%

JSON

Martin Lambers msmtp before 1.4.19, when OpenSSL is used, does not properly handle a ‘\0’ character in a domain name in the (1) subject’s Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected configurations

NVD

Node

martin_lambersmsmtpRange≤1.4.18

martin_lambersmsmtpMatch0.2.5

martin_lambersmsmtpMatch0.2.6

martin_lambersmsmtpMatch0.3.0

martin_lambersmsmtpMatch0.3.1

martin_lambersmsmtpMatch0.4.0

martin_lambersmsmtpMatch0.4.1

martin_lambersmsmtpMatch0.4.2

martin_lambersmsmtpMatch0.5.0

martin_lambersmsmtpMatch0.5.1

martin_lambersmsmtpMatch0.5.2

martin_lambersmsmtpMatch0.5.3

martin_lambersmsmtpMatch0.6.0

martin_lambersmsmtpMatch0.6.1

martin_lambersmsmtpMatch0.6.2

martin_lambersmsmtpMatch0.6.3

martin_lambersmsmtpMatch0.6.4

martin_lambersmsmtpMatch0.6.5

martin_lambersmsmtpMatch0.6.6

martin_lambersmsmtpMatch0.7.0

martin_lambersmsmtpMatch0.7.1

martin_lambersmsmtpMatch0.7.2

martin_lambersmsmtpMatch1.0.0

martin_lambersmsmtpMatch1.2.0

martin_lambersmsmtpMatch1.2.1

martin_lambersmsmtpMatch1.2.2

martin_lambersmsmtpMatch1.2.3

martin_lambersmsmtpMatch1.2.4

martin_lambersmsmtpMatch1.4.0

martin_lambersmsmtpMatch1.4.1

martin_lambersmsmtpMatch1.4.2

martin_lambersmsmtpMatch1.4.3

martin_lambersmsmtpMatch1.4.4

martin_lambersmsmtpMatch1.4.5

martin_lambersmsmtpMatch1.4.6

martin_lambersmsmtpMatch1.4.7

martin_lambersmsmtpMatch1.4.8

martin_lambersmsmtpMatch1.4.9

martin_lambersmsmtpMatch1.4.10

martin_lambersmsmtpMatch1.4.11

martin_lambersmsmtpMatch1.4.12

martin_lambersmsmtpMatch1.4.13

martin_lambersmsmtpMatch1.4.14

martin_lambersmsmtpMatch1.4.15

martin_lambersmsmtpMatch1.4.16

martin_lambersmsmtpMatch1.4.17

VendorProductVersionCPE
martin_lambersmsmtp0.2.6cpe:/a:martin_lambers:msmtp:0.2.6:::
martin_lambersmsmtp1.4.12cpe:/a:martin_lambers:msmtp:1.4.12:::
martin_lambersmsmtp0.5.3cpe:/a:martin_lambers:msmtp:0.5.3:::
martin_lambersmsmtp0.4.2cpe:/a:martin_lambers:msmtp:0.4.2:::
martin_lambersmsmtp0.5.2cpe:/a:martin_lambers:msmtp:0.5.2:::
martin_lambersmsmtpcpe:/a:martin_lambers:msmtp::::
martin_lambersmsmtp1.4.0cpe:/a:martin_lambers:msmtp:1.4.0:::
martin_lambersmsmtp0.6.2cpe:/a:martin_lambers:msmtp:0.6.2:::
martin_lambersmsmtp1.4.17cpe:/a:martin_lambers:msmtp:1.4.17:::
martin_lambersmsmtp1.2.1cpe:/a:martin_lambers:msmtp:1.2.1:::

Vendor	Product	Version	CPE
martin_lambers	msmtp	0.2.6	cpe:/a:martin_lambers:msmtp:0.2.6:::
martin_lambers	msmtp	1.4.12	cpe:/a:martin_lambers:msmtp:1.4.12:::
martin_lambers	msmtp	0.5.3	cpe:/a:martin_lambers:msmtp:0.5.3:::
martin_lambers	msmtp	0.4.2	cpe:/a:martin_lambers:msmtp:0.4.2:::
martin_lambers	msmtp	0.5.2	cpe:/a:martin_lambers:msmtp:0.5.2:::
martin_lambers	msmtp		cpe:/a:martin_lambers:msmtp::::
martin_lambers	msmtp	1.4.0	cpe:/a:martin_lambers:msmtp:1.4.0:::
martin_lambers	msmtp	0.6.2	cpe:/a:martin_lambers:msmtp:0.6.2:::
martin_lambers	msmtp	1.4.17	cpe:/a:martin_lambers:msmtp:1.4.17:::
martin_lambers	msmtp	1.2.1	cpe:/a:martin_lambers:msmtp:1.2.1:::