The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Metrics
Affected Vendors & Products
Advisories
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-400-1 | pound security update |
Debian DSA |
DSA-1934-1 | New apache2 packages fix several issues |
Debian DSA |
DSA-2141-1 | New openssl packages fix protocol design flaw |
Debian DSA |
DSA-2141-2 | New nss packages fix protocol design flaw |
Debian DSA |
DSA-2141-4 | New lighttpd packages fix regression |
Debian DSA |
DSA-2161-2 | OpenJDK security update |
Debian DSA |
DSA-2626-1 | lighttpd security update |
Debian DSA |
DSA-3253-1 | pound security update |
EUVD |
EUVD-2022-3720 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. |
Github GHSA |
GHSA-f7w7-6pjc-wwm6 | Apache Tomcat affected by vulnerability in TLS and SSL protocol |
Ubuntu USN |
USN-860-1 | Apache vulnerabilities |
Ubuntu USN |
USN-1010-1 | OpenJDK vulnerabilities |
Ubuntu USN |
USN-923-1 | OpenJDK vulnerabilities |
Ubuntu USN |
USN-927-1 | NSS vulnerability |
Ubuntu USN |
USN-927-4 | nss vulnerability |
Ubuntu USN |
USN-927-6 | NSS vulnerability |
Ubuntu USN |
USN-990-1 | OpenSSL vulnerability |
Ubuntu USN |
USN-990-2 | Apache vulnerability |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2024-08-07T06:31:10.430Z
Reserved: 2009-10-05T00:00:00
Link: CVE-2009-3555
No data.
Status : Deferred
Published: 2009-11-09T17:30:00.407
Modified: 2025-04-09T00:30:58.490
Link: CVE-2009-3555
OpenCVE Enrichment
No data.
Debian DLA
Debian DSA
EUVD
Github GHSA
Ubuntu USN