p PatchFirst

CVE-2009-2409

CVE-2009-2409

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

EPSS 4.3% · Fix available

Published
Updated

Stack: system · network

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • nss Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.12.3-1

    Update to 3.12.3-1

  • nss Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.12.3-1

    Update to 3.12.3-1

  • nss Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.12.3-1

    Update to 3.12.3-1

  • openssl Debian:12

    Affected ranges
    • ECOSYSTEM: < 0.9.8k-4

    Update to 0.9.8k-4

  • openssl Debian:13

    Affected ranges
    • ECOSYSTEM: < 0.9.8k-4

    Update to 0.9.8k-4

  • openssl Debian:14

    Affected ranges
    • ECOSYSTEM: < 0.9.8k-4

    Update to 0.9.8k-4

Original sources

Check your server →