CVE-2009-1390

State: Published
Severity: Not scored
Published: Jun 16, 2009
Updated: Aug 7, 2024
Reserved: Apr 23, 2009

Description

Mutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

35288vdb-entry
FEDORA-2009-6465vendor-advisory
http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a
mutt-x509-security-bypass(51068)vdb-entry
http://dev.mutt.org/hg/mutt/rev/8f11dd00c770
[oss-security] 20090610 Mutt 1.5.19 SSL chain verification flawmailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.