Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-F7W7-6PJC-WWM6
HistoryMay 02, 2022 - 3:46 a.m.

Apache Tomcat affected by vulnerability in TLS and SSL protocol

2022-05-0203:46:22
CWE-295
GitHub Advisory Database
github.com
14

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.4%

JSON

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a “plaintext injection” attack, aka the “Project Mogul” issue.

Apache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.

Affected configurations

Vulners
Node
org.apache.tomcat\Matchtomcat
OR
org.apache.tomcat\Matchtomcat
OR
org.apache.tomcat\Matchtomcat

References

Related

nessus 66
ubuntu 4
cvelist 1
securityvulns 7
veracode 1
openvas 63
debian 6
fedora 10
fortinet 1
mozilla 1
redhat 3
suse 1
seebug 4
altlinux 4
hackerone 2
cve 1
cisco 2
nvd 1
oraclelinux 2
centos 2
slackware 1
packetstorm 1
f5 2
openssl 1
ubuntucve 1
freebsd_advisory 1
prion 1
checkpoint_advisories 3
osv 1
exploitpack 1
cert 1
debiancve 1
ibm 1
nginx 1
nessus
nessus
Fedora 13 : nss-3.12.6-1.2.fc13 (2010-3929)
2010-07-01 00:00:00
openSUSE Security Update : libfreebl3 (openSUSE-SU-2010:0100-1)
2010-04-13 00:00:00
SuSE9 Security Update : GnuTLS (YOU Patch Number 12705)
2011-05-02 00:00:00
ubuntu
ubuntu
nss vulnerability
2010-06-29 00:00:00
NSS vulnerability
2010-07-23 00:00:00
Apache vulnerability
2010-09-21 00:00:00
cvelist
cvelist
CVE-2009-3555
2009-11-09 17:00:00
securityvulns
securityvulns
SSL data injection
2010-02-10 00:00:00
[ MDVSA-2009:337 ] proftpd
2009-12-22 00:00:00
[ MDVSA-2009:295 ] apache
2009-11-09 00:00:00
veracode
veracode
Man-in-the-Middle (MitM)
2020-04-10 00:36:56
openvas
openvas
RedHat Update for nss RHSA-2010:0165-01
2010-03-31 00:00:00
SLES10: Security update for OpenSSL
2009-11-17 00:00:00
Fedora Core 12 FEDORA-2009-12968 (nss-util)
2009-12-14 00:00:00
debian
debian
[SECURITY] [DSA-2141-1] New apache2 packages add backward compatibility option
2011-01-05 23:21:00
[SECURITY] [DSA-2141-4] New lighttpd packages fix regression
2011-01-12 18:51:18
[SECURITY] [DSA-2141-2] New nss packages fix protocol design flaw
2011-01-05 23:20:31
fedora
fedora
[SECURITY] Fedora 12 Update: nss-util-3.12.5-1.fc12.1
2009-12-10 04:13:15
[SECURITY] Fedora 12 Update: gnutls-2.8.6-2.fc12
2010-06-25 18:15:19
[SECURITY] Fedora 12 Update: nss-3.12.6-1.2.fc12
2010-03-12 04:18:37
fortinet
fortinet
FortiOS SSL Deep-Inspection possible Insecure Renegotiation
2017-11-03 00:00:00
mozilla
mozilla
Update NSS to support TLS renegotiation indication — Mozilla
2010-03-30 00:00:00
redhat
redhat
(RHSA-2010:0164) Moderate: openssl097a security update
2010-03-25 00:00:00
(RHSA-2010:0155) Moderate: java-1.4.2-ibm security and bug fix update
2010-03-17 00:00:00
(RHSA-2010:0165) Moderate: nss security update
2010-03-25 00:00:00
suse
suse
man-in-the-middle attack in openssl
2009-11-18 09:50:39
seebug
seebug
ProFTPD TLS会话重协商明文数据注入漏洞
2009-12-15 00:00:00
Cisco Security Advisory: Transport Layer Security Renegotiation Vulnerability
2009-11-10 00:00:00
TLS Renegotiation Vulnerability PoC Exploit
2009-12-21 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 8 package openssl10 version 0.9.8l-alt1
2009-11-07 00:00:00
Security fix for the ALT Linux 9 package openssl1.1 version 0.9.8l-alt1
2009-11-07 00:00:00
Security fix for the ALT Linux 6 package openssl10 version 0.9.8l-alt1
2009-11-07 00:00:00
hackerone
hackerone
LocalTapiola: Secure Client-Initiated Renegotiation
2017-12-27 15:57:52
Slack: TLS1/SSLv3 Renegotiation Vulnerability
2014-04-02 13:01:00
cve
cve
CVE-2009-3555
2009-11-09 17:30:00
cisco
cisco
Transport Layer Security Renegotiation Vulnerability
2009-11-09 13:00:00
Transport Layer Security Renegotiation Remote Man-in-the-Middle Attack Vulnerability
2009-11-05 19:53:52
nvd
nvd
CVE-2009-3555
2009-11-09 17:30:00
oraclelinux
oraclelinux
openssl097a security update
2010-03-25 00:00:00
nss security update
2010-03-25 00:00:00
centos
centos
openssl097a security update
2010-03-27 17:44:36
nspr, nss security update
2010-03-28 15:36:50
slackware
slackware
openssl
2009-11-16 13:42:36
packetstorm
packetstorm
TLS Renegotiation Exploit
2009-12-21 00:00:00
f5
f5
K10737 : SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
2013-07-05 00:00:00
SOL10737 - SSL Renegotiation vulnerability - CVE-2009-3555 / VU#120541
2009-11-05 00:00:00
openssl
openssl
Vulnerability in OpenSSL CVE-2009-3555
2009-11-05 00:00:00
ubuntucve
ubuntucve
CVE-2009-3555
2009-11-09 00:00:00
freebsd_advisory
freebsd_advisory
FreeBSD-SA-09:15.ssl
2009-12-03 00:00:00
prion
prion
Cross site request forgery (csrf)
2009-11-09 17:30:00
checkpoint_advisories
checkpoint_advisories
TLS Renegotiation (CVE-2009-3555)
2009-11-22 00:00:00
TLS Client Initiated Renegotiation (CVE-2009-3555)
2009-11-23 00:00:00
Preemptive Protection against TLS and SSL Spoofing Vulnerability
2010-02-09 00:00:00
osv
osv
Apache Tomcat affected by vulnerability in TLS and SSL protocol
2022-05-02 03:46:22
exploitpack
exploitpack
TLS - Renegotiation
2009-12-21 00:00:00
cert
cert
SSL and TLS protocols renegotiation vulnerability
2009-11-11 00:00:00
debiancve
debiancve
CVE-2009-3555
2009-11-09 17:30:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities have been identified in IBM Tivoli Netcool/OMNIbus Probe for Network Node Manager i (CVE-2009-3555)
2020-06-23 08:41:14
nginx
nginx
The renegotiation vulnerability in SSL protocol
2009-11-09 17:30:00

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

6.7 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.4%

JSON
Related for GHSA-F7W7-6PJC-WWM6
nessus66ubuntu4cvelist1securityvulns7veracode1openvas63debian6fedora10fortinet1mozilla1redhat3suse1seebug4altlinux4hackerone2cve1cisco2nvd1oraclelinux2centos2slackware1packetstorm1f52openssl1ubuntucve1freebsd_advisory1prion1checkpoint_advisories3osv1exploitpack1cert1debiancve1ibm1nginx1