Description
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
No analysis available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-400-1 | pound security update |
Debian DSA |
DSA-1934-1 | New apache2 packages fix several issues |
Debian DSA |
DSA-2141-1 | New openssl packages fix protocol design flaw |
Debian DSA |
DSA-2141-2 | New nss packages fix protocol design flaw |
Debian DSA |
DSA-2141-4 | New lighttpd packages fix regression |
Debian DSA |
DSA-2161-2 | OpenJDK security update |
Debian DSA |
DSA-2626-1 | lighttpd security update |
Debian DSA |
DSA-3253-1 | pound security update |
EUVD |
EUVD-2022-3720 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. |
Github GHSA |
GHSA-f7w7-6pjc-wwm6 | Apache Tomcat affected by vulnerability in TLS and SSL protocol |
Ubuntu USN |
USN-860-1 | Apache vulnerabilities |
Ubuntu USN |
USN-1010-1 | OpenJDK vulnerabilities |
Ubuntu USN |
USN-923-1 | OpenJDK vulnerabilities |
Ubuntu USN |
USN-927-1 | NSS vulnerability |
Ubuntu USN |
USN-927-4 | nss vulnerability |
Ubuntu USN |
USN-927-6 | NSS vulnerability |
Ubuntu USN |
USN-990-1 | OpenSSL vulnerability |
Ubuntu USN |
USN-990-2 | Apache vulnerability |
References
History
No history.
Subscriptions
Apache
Subscribe
Http Server
Subscribe
Canonical
Subscribe
Ubuntu Linux
Subscribe
Debian
Subscribe
Debian Linux
Subscribe
F5
Subscribe
Nginx
Subscribe
Fedoraproject
Subscribe
Fedora
Subscribe
Gnu
Subscribe
Gnutls
Subscribe
Mozilla
Subscribe
Nss
Subscribe
Openssl
Subscribe
Openssl
Subscribe
Redhat
Subscribe
Enterprise Linux
Subscribe
Jboss Enterprise Web Server
Subscribe
Network Satellite
Subscribe
Rhel Extras
Subscribe
Rhel Extras Sap
Subscribe
Satellite
Subscribe
Satellite Capsule
Subscribe
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T06:31:10.430Z
Reserved: 2009-10-05T00:00:00.000Z
Link: CVE-2009-3555
No data.
Status : Deferred
Published: 2009-11-09T17:30:00.407
Modified: 2025-04-09T00:30:58.490
Link: CVE-2009-3555
OpenCVE Enrichment
No data.
Debian DLA
Debian DSA
EUVD
Github GHSA
Ubuntu USN