CVE-2009-3765

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2009-10-23T19:00:00.000Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "[oss-security] 20090923 Re: More CVE-2009-2408 like issues", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://marc.info/?l=oss-security&m=125369675820512&w=2"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c"}, {"name": "SUSE-SR:2009:016", "tags": ["vendor-advisory", "x_refsource_SUSE"], "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"}, {"name": "[oss-security] 20090903 More CVE-2009-2408 like issues", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://marc.info/?l=oss-security&m=125198917018936&w=2"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2009-3765", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20090923 Re: More CVE-2009-2408 like issues", "refsource": "MLIST", "url": "http://marc.info/?l=oss-security&m=125369675820512&w=2"}, {"name": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c", "refsource": "CONFIRM", "url": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c"}, {"name": "SUSE-SR:2009:016", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"}, {"name": "[oss-security] 20090903 More CVE-2009-2408 like issues", "refsource": "MLIST", "url": "http://marc.info/?l=oss-security&m=125198917018936&w=2"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T06:38:30.362Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20090923 Re: More CVE-2009-2408 like issues", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://marc.info/?l=oss-security&m=125369675820512&w=2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c"}, {"name": "SUSE-SR:2009:016", "tags": ["vendor-advisory", "x_refsource_SUSE", "x_transferred"], "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"}, {"name": "[oss-security] 20090903 More CVE-2009-2408 like issues", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://marc.info/?l=oss-security&m=125198917018936&w=2"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2009-3765", "datePublished": "2009-10-23T19:00:00.000Z", "dateReserved": "2009-10-23T00:00:00.000Z", "dateUpdated": "2024-09-16T20:22:26.580Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mutt:mutt:1.5.19:*:*:*:*:*:*:*", "matchCriteriaId": "89C33B31-B9BC-4E43-8221-219380B4B682", "vulnerable": true}, {"criteria": "cpe:2.3:a:mutt:mutt:1.5.20:*:*:*:*:*:*:*", "matchCriteriaId": "591AA471-643C-49FB-8922-F91774946177", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "DDA1CA86-1405-4C25-9BC2-5A5E6A76B911", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."}, {"lang": "es", "value": "mutt_ssl.c en mutt 1.5.19 y 1.5.20, cuando usa OenSSL, no maneja de forma adecuada el caracter '\\0' en un nombre de dominio, dentro del campo sujeto del Common Name (CN) en los certificados X.509, lo que permite a atacantes man-in-the-middle, esp\u00edar servidores SSL de su elecci\u00f3n a trav\u00e9s de certificados manipulados concedidos por Autoridades Certificadoras, esta relacionado con CVE-2009-2408."}], "id": "CVE-2009-3765", "lastModified": "2026-06-16T23:12:18.997", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2009-10-23T19:30:00.203", "references": [{"source": "cve@mitre.org", "url": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c"}, {"source": "cve@mitre.org", "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=oss-security&m=125198917018936&w=2"}, {"source": "cve@mitre.org", "url": "http://marc.info/?l=oss-security&m=125369675820512&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=oss-security&m=125198917018936&w=2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://marc.info/?l=oss-security&m=125369675820512&w=2"}], "sourceIdentifier": "cve@mitre.org", "vendorComments": [{"comment": "Not vulnerable. This issue did not affect the versions of mutt as shipped with Red Hat Enterprise Linux 3, 4, or 5.\n", "lastModified": "2009-10-26T00:00:00", "organization": "Red Hat"}], "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "mutt: Doesn't properly handle NULL character in subject Common Name", "id": "530713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=530713"}, "csaw": false, "cvss": {"cvss_base_score": "4.3", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "status": "draft"}, "details": ["mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."], "name": "CVE-2009-3765", "public_date": "2009-08-11T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2009-3765"], "statement": "Not vulnerable. This issue did not affect the versions of mutt as shipped with Red Hat Enterprise Linux 3, 4, or 5.", "threat_severity": "Moderate"}

{}