Lucene search

[email protected]NVD:CVE-2009-2730

HistoryAug 12, 2009 - 10:30 a.m.

CVE-2009-2730

2009-08-1210:30:01

CWE-310

[email protected]

web.nvd.nist.gov

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

libgnutls in GnuTLS before 2.8.2 does not properly handle a ‘\0’ character in a domain name in the subject’s (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Affected configurations

NVD

Node

gnugnutlsRange≤2.8.1

gnugnutlsMatch1.0.16

gnugnutlsMatch1.0.17

gnugnutlsMatch1.0.18

gnugnutlsMatch1.0.19

gnugnutlsMatch1.0.20

gnugnutlsMatch1.0.21

gnugnutlsMatch1.0.22

gnugnutlsMatch1.0.23

gnugnutlsMatch1.0.24

gnugnutlsMatch1.0.25

gnugnutlsMatch1.1.13

gnugnutlsMatch1.1.14

gnugnutlsMatch1.1.15

gnugnutlsMatch1.1.16

gnugnutlsMatch1.1.17

gnugnutlsMatch1.1.18

gnugnutlsMatch1.1.19

gnugnutlsMatch1.1.20

gnugnutlsMatch1.1.21

gnugnutlsMatch1.1.22

gnugnutlsMatch1.1.23

gnugnutlsMatch1.2.0

gnugnutlsMatch1.2.1

gnugnutlsMatch1.2.2

gnugnutlsMatch1.2.3

gnugnutlsMatch1.2.4

gnugnutlsMatch1.2.5

gnugnutlsMatch1.2.6

gnugnutlsMatch1.2.7

gnugnutlsMatch1.2.8

gnugnutlsMatch1.2.8.1a1

gnugnutlsMatch1.2.9

gnugnutlsMatch1.2.10

gnugnutlsMatch1.2.11

gnugnutlsMatch1.3.0

gnugnutlsMatch1.3.1

gnugnutlsMatch1.3.2

gnugnutlsMatch1.3.3

gnugnutlsMatch1.3.4

gnugnutlsMatch1.3.5

gnugnutlsMatch1.4.0

gnugnutlsMatch1.4.1

gnugnutlsMatch1.4.2

gnugnutlsMatch1.4.3

gnugnutlsMatch1.4.4

gnugnutlsMatch1.4.5

gnugnutlsMatch1.5.0

gnugnutlsMatch1.5.1

gnugnutlsMatch1.5.2

gnugnutlsMatch1.5.3

gnugnutlsMatch1.5.4

gnugnutlsMatch1.5.5

gnugnutlsMatch1.6.0

gnugnutlsMatch1.6.1

gnugnutlsMatch1.6.2

gnugnutlsMatch1.6.3

gnugnutlsMatch1.7.0

gnugnutlsMatch1.7.1

gnugnutlsMatch1.7.2

gnugnutlsMatch1.7.3

gnugnutlsMatch1.7.4

gnugnutlsMatch1.7.5

gnugnutlsMatch1.7.6

gnugnutlsMatch1.7.7

gnugnutlsMatch1.7.8

gnugnutlsMatch1.7.9

gnugnutlsMatch1.7.10

gnugnutlsMatch1.7.11

gnugnutlsMatch1.7.12

gnugnutlsMatch1.7.13

gnugnutlsMatch1.7.14

gnugnutlsMatch1.7.15

gnugnutlsMatch1.7.16

gnugnutlsMatch1.7.17

gnugnutlsMatch1.7.18

gnugnutlsMatch1.7.19

gnugnutlsMatch2.0.0

gnugnutlsMatch2.0.1

gnugnutlsMatch2.0.2

gnugnutlsMatch2.0.3

gnugnutlsMatch2.0.4

gnugnutlsMatch2.1.0

gnugnutlsMatch2.1.1

gnugnutlsMatch2.1.2

gnugnutlsMatch2.1.3

gnugnutlsMatch2.1.4

gnugnutlsMatch2.1.5

gnugnutlsMatch2.1.6

gnugnutlsMatch2.1.7

gnugnutlsMatch2.1.8

gnugnutlsMatch2.2.0

gnugnutlsMatch2.2.1

gnugnutlsMatch2.2.2

gnugnutlsMatch2.2.3

gnugnutlsMatch2.2.4

gnugnutlsMatch2.2.5

gnugnutlsMatch2.3.0

gnugnutlsMatch2.3.1

gnugnutlsMatch2.3.2

gnugnutlsMatch2.3.3

gnugnutlsMatch2.3.4

gnugnutlsMatch2.3.5

gnugnutlsMatch2.3.6

gnugnutlsMatch2.3.7

gnugnutlsMatch2.3.8

gnugnutlsMatch2.3.9

gnugnutlsMatch2.3.10

gnugnutlsMatch2.3.11

gnugnutlsMatch2.4.0

gnugnutlsMatch2.4.1

gnugnutlsMatch2.4.2

gnugnutlsMatch2.5.0

gnugnutlsMatch2.6.0

gnugnutlsMatch2.6.1

gnugnutlsMatch2.6.2

gnugnutlsMatch2.6.3

gnugnutlsMatch2.6.4

gnugnutlsMatch2.6.5

gnugnutlsMatch2.6.6

gnugnutlsMatch2.8.0

References

article.gmane.org/gmane.network.gnutls.general/1733

lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html

secunia.com/advisories/36266

secunia.com/advisories/36496

www.openwall.com/lists/oss-security/2009/08/14/6

www.redhat.com/support/errata/RHSA-2009-1232.html

www.securityfocus.com/archive/1/507985/100/0/threaded

www.securitytracker.com/id?1022777

www.vmware.com/security/advisories/VMSA-2009-0016.html

exchange.xforce.ibmcloud.com/vulnerabilities/52404

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10778

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8409

rhn.redhat.com/errata/RHSA-2010-0095.html

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

5.9 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.9%

JSON

Related for NVD:CVE-2009-2730

openvas35 cvelist1 nessus21 centos2 fedora2 ubuntucve1 oraclelinux1 freebsd1 cve1 redhat2 slackware1 prion1 gentoo2 securityvulns2 osv1 debian1 ubuntu1 vmware1