CVE-2009-2409
30.07.2009, 19:30
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gnu | gnutls | 𝑥 < 2.6.4 |
| gnu | gnutls | 2.7.0 ≤ 𝑥 < 2.7.4 |
| mozilla | network_security_services | 𝑥 < 3.12.3 |
| openssl | openssl | 0.9.8 ≤ 𝑥 ≤ 0.9.8k |
𝑥
= Vulnerable software versions
Debian Releases
Debian Product | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| nss |
| ||||||||||||
| openssl |
|
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| gnutls12 |
| ||||||||||||||
| gnutls13 |
| ||||||||||||||
| gnutls26 |
| ||||||||||||||
| nss |
| ||||||||||||||
| openjdk-6 |
| ||||||||||||||
| openssl |
|
Common Weakness Enumeration
References