CVE-2009-2417
CVE-2009-2417
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
EPSS 3.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch
- http://www.securityfocus.com/archive/1/506055/100/0/threaded
- http://secunia.com/advisories/37471
- http://www.vupen.com/english/advisories/2009/2263
- http://www.ubuntu.com/usn/USN-1158-1
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://secunia.com/advisories/36238
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52405
- http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch
- http://wiki.rpath.com/Advisories:rPSA-2009-0124
- http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542
- http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://support.apple.com/kb/HT4077
- http://shibboleth.internet2.edu/secadv/secadv_20090817.txt
- http://secunia.com/advisories/36475
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114
- http://curl.haxx.se/docs/adv_20090812.txt
- https://nvd.nist.gov/vuln/detail/CVE-2009-2417