CVEvulnerability
CVE-2009-3766
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-10-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-310
Description
mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Affected configurations
• mutt mutt (>= 1.5.16 < 1.5.19)
Related
Weakness · not in database (1)
References
- http://dev.mutt.org/trac/ticket/3087 Patch, Vendor Advisory
- http://marc.info/?l=oss-security&m=125198917018936&w=2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2009/10/26/1 Mailing List, Third Party Advisory
- http://dev.mutt.org/trac/ticket/3087 Patch, Vendor Advisory
- http://marc.info/?l=oss-security&m=125198917018936&w=2 Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2009/10/26/1 Mailing List, Third Party Advisory