CVE-2009-2409
Medium
Description
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
SeverityMedium
CVSS5.1
Exploit probability—
Product
Gnutls
PublishedJul 30, 2009
First seenJul 30, 2009
How to fix
Update
- gnu gnutls2.6.4, 2.7.4 or later
- mozilla network_security_services3.12.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gnu gnutls | v < 2.6.4, 2.7.0 ≤ v < 2.7.4 | 2.6.4, 2.7.4 |
| mozilla network_security_services | v < 3.12.3 | 3.12.3 |
| openssl openssl | 0.9.8 ≤ v ≤ 0.9.8k | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.