CVE-2009-2409
Fixed in a distro release EPSS 4%
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Products: gnutls, mozilla network_security_services, openssl
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | firefox | 0 |
| Debian 12 | nss | 3.12.3-1 |
| Debian 12 | openssl | 0.9.8k-4 |
| Debian 13 | nss | 3.12.3-1 |
| Debian 13 | openssl | 0.9.8k-4 |
| Debian 14 | nss | 3.12.3-1 |
| Debian 14 | openssl | 0.9.8k-4 |
| Debian 4.0 | gnutls13 | 1.4.4-3+etch5 |
| Debian 4.0 | openssl | 0.9.8c-4etch9 |
| Debian 4.0 | openssl097 | 0.9.7k-3.1etch5 |
| Debian 5.0 | gnutls26 | 2.4.2-6+lenny2 |
| Debian 5.0 | nss | 3.12.3.1-0lenny1 |
| Debian 5.0 | openssl | 0.9.8g-15+lenny5 |
| Red Hat Enterprise Linux 3 | openssl | 0:0.9.7a-33.26 |
| Red Hat Enterprise Linux 3 | openssl-debuginfo | 0:0.9.7a-33.26 |
| Red Hat Enterprise Linux 3 | openssl-devel | 0:0.9.7a-33.26 |
| Red Hat Enterprise Linux 3 | openssl-perl | 0:0.9.7a-33.26 |
| Red Hat Enterprise Linux 3 | seamonkey | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-chat | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-debuginfo | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-devel | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-dom-inspector | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-js-debugger | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-mail | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nspr-devel | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 3 | seamonkey-nss-devel | 0:1.0.9-0.45.el3 |
| Red Hat Enterprise Linux 4 | nspr | 0:4.7.4-1.el4_8.1 |
| Red Hat Enterprise Linux 4 | nspr-debuginfo | 0:4.7.4-1.el4_8.1 |
| Red Hat Enterprise Linux 4 | nspr-devel | 0:4.7.4-1.el4_8.1 |
| Red Hat Enterprise Linux 4 | nss | 0:3.12.3.99.3-1.el4_8.2 |
| Red Hat Enterprise Linux 4 | nss-debuginfo | 0:3.12.3.99.3-1.el4_8.2 |
| Red Hat Enterprise Linux 4 | nss-devel | 0:3.12.3.99.3-1.el4_8.2 |
| Red Hat Enterprise Linux 4 | nss-tools | 0:3.12.3.99.3-1.el4_8.2 |
| Red Hat Enterprise Linux 4 | openssl | 0:0.9.7a-43.17.el4_8.5 |
| Red Hat Enterprise Linux 4 | openssl-debuginfo | 0:0.9.7a-43.17.el4_8.5 |
| Red Hat Enterprise Linux 4 | openssl-devel | 0:0.9.7a-43.17.el4_8.5 |
| Red Hat Enterprise Linux 4 | openssl-perl | 0:0.9.7a-43.17.el4_8.5 |
| Red Hat Enterprise Linux 5 | gnutls | 0:1.4.1-3.el5_4.8 |
| Red Hat Enterprise Linux 5 | gnutls-debuginfo | 0:1.4.1-3.el5_4.8 |
| Red Hat Enterprise Linux 5 | gnutls-devel | 0:1.4.1-3.el5_4.8 |
| Red Hat Enterprise Linux 5 | gnutls-utils | 0:1.4.1-3.el5_4.8 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk | 1:1.6.0.0-1.7.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-debuginfo | 1:1.6.0.0-1.7.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-demo | 1:1.6.0.0-1.7.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-devel | 1:1.6.0.0-1.7.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-javadoc | 1:1.6.0.0-1.7.b09.el5 |
| Red Hat Enterprise Linux 5 | java-1.6.0-openjdk-src | 1:1.6.0.0-1.7.b09.el5 |
| Red Hat Enterprise Linux 5 | nspr | 0:4.7.4-1.el5_3.1 |
| Red Hat Enterprise Linux 5 | nspr-debuginfo | 0:4.7.4-1.el5_3.1 |
| Red Hat Enterprise Linux 5 | nspr-devel | 0:4.7.4-1.el5_3.1 |
| Red Hat Enterprise Linux 5 | nss | 0:3.12.3.99.3-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | nss-debuginfo | 0:3.12.3.99.3-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | nss-devel | 0:3.12.3.99.3-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | nss-pkcs11-devel | 0:3.12.3.99.3-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | nss-tools | 0:3.12.3.99.3-1.el5_3.2 |
| Red Hat Enterprise Linux 5 | openssl | 0:0.9.8e-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | openssl-debuginfo | 0:0.9.8e-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | openssl-devel | 0:0.9.8e-12.el5_4.1 |
| Red Hat Enterprise Linux 5 | openssl-perl | 0:0.9.8e-12.el5_4.1 |
| Red Hat network satellite 5.1 | java-1.5.0-sun | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat network satellite 5.1 | java-1.5.0-sun-devel | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel eus 4.7 | nspr | 0:4.7.4-1.el4_7.1 |
| Red Hat rhel eus 4.7 | nspr-debuginfo | 0:4.7.4-1.el4_7.1 |
| Red Hat rhel eus 4.7 | nspr-devel | 0:4.7.4-1.el4_7.1 |
| Red Hat rhel eus 4.7 | nss | 0:3.12.3.99.3-1.el4_7.6 |
| Red Hat rhel eus 4.7 | nss-debuginfo | 0:3.12.3.99.3-1.el4_7.6 |
| Red Hat rhel eus 4.7 | nss-devel | 0:3.12.3.99.3-1.el4_7.6 |
| Red Hat rhel eus 5.2 | nspr | 0:4.7.4-1.el5_2 |
| Red Hat rhel eus 5.2 | nspr-debuginfo | 0:4.7.4-1.el5_2 |
| Red Hat rhel eus 5.2 | nspr-devel | 0:4.7.4-1.el5_2 |
| Red Hat rhel eus 5.2 | nss | 0:3.12.3.99.3-1.el5_2 |
| Red Hat rhel eus 5.2 | nss-debuginfo | 0:3.12.3.99.3-1.el5_2 |
| Red Hat rhel eus 5.2 | nss-devel | 0:3.12.3.99.3-1.el5_2 |
| Red Hat rhel eus 5.2 | nss-pkcs11-devel | 0:3.12.3.99.3-1.el5_2 |
| Red Hat rhel eus 5.2 | nss-tools | 0:3.12.3.99.3-1.el5_2 |
| Red Hat rhel extras 4 | java-1.5.0-sun | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.5.0-sun-demo | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.5.0-sun-devel | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.5.0-sun-jdbc | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.5.0-sun-plugin | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.5.0-sun-src | 0:1.5.0.22-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.6.0-sun | 1:1.6.0.17-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.6.0-sun-demo | 1:1.6.0.17-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.6.0-sun-devel | 1:1.6.0.17-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.6.0-sun-jdbc | 1:1.6.0.17-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.6.0-sun-plugin | 1:1.6.0.17-1jpp.1.el4 |
| Red Hat rhel extras 4 | java-1.6.0-sun-src | 1:1.6.0.17-1jpp.1.el4 |
| Red Hat rhel extras 5 | java-1.5.0-sun | 0:1.5.0.22-1jpp.1.el5 |
| Red Hat rhel extras 5 | java-1.5.0-sun-demo | 0:1.5.0.22-1jpp.1.el5 |
| Red Hat rhel extras 5 | java-1.5.0-sun-devel | 0:1.5.0.22-1jpp.1.el5 |
| Red Hat rhel extras 5 | java-1.5.0-sun-jdbc | 0:1.5.0.22-1jpp.1.el5 |
| Red Hat rhel extras 5 | java-1.5.0-sun-plugin | 0:1.5.0.22-1jpp.1.el5 |
| Red Hat rhel extras 5 | java-1.5.0-sun-src | 0:1.5.0.22-1jpp.1.el5 |
| Red Hat rhel extras 5 | java-1.6.0-sun | 1:1.6.0.17-1jpp.2.el5 |
| Red Hat rhel extras 5 | java-1.6.0-sun-demo | 1:1.6.0.17-1jpp.2.el5 |
| Red Hat rhel extras 5 | java-1.6.0-sun-devel | 1:1.6.0.17-1jpp.2.el5 |
| Red Hat rhel extras 5 | java-1.6.0-sun-jdbc | 1:1.6.0.17-1jpp.2.el5 |
| Red Hat rhel extras 5 | java-1.6.0-sun-plugin | 1:1.6.0.17-1jpp.2.el5 |
| Red Hat rhel extras 5 | java-1.6.0-sun-src | 1:1.6.0.17-1jpp.2.el5 |
| Wolfi | firefox | 0 |