CVE-2009-3555
First published: Thu Nov 05 2009(Updated: )
Marsh Ray of PhoneFactor has discovered a flaw in the TLS/SSL protocol related to the handling of the session rehandshakes / renegotiations. This flaw can possibly be used in the MITM attacks and allowing an attacker to inject attacker-chosen plain text prefix to the session of the victim. Further details are available in the "Authentication Gap in TLS Renegotiation" blog post: <a href="http://extendedsubset.com/?p=8">http://extendedsubset.com/?p=8</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.4.2-ibm-0:1.4.2.13.4-1jpp.1.el3 | 1.4.2-ibm-0:1.4.2.13.4-1jpp.1.el3 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.6-1jpp.3.el3 | 1.4.2-ibm-0:1.4.2.13.6-1jpp.3.el3 |
| redhat/java | <1.6.0-ibm-1:1.6.0.7-1jpp.3.el4 | 1.6.0-ibm-1:1.6.0.7-1jpp.3.el4 |
| redhat/java | <1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4 | 1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.4-1jpp.1.el4 | 1.4.2-ibm-0:1.4.2.13.4-1jpp.1.el4 |
| redhat/java | <1.6.0-sun-1:1.6.0.19-1jpp.1.el4 | 1.6.0-sun-1:1.6.0.19-1jpp.1.el4 |
| redhat/java | <1.5.0-sun-0:1.5.0.22-1jpp.3.el4 | 1.5.0-sun-0:1.5.0.22-1jpp.3.el4 |
| redhat/java | <1.6.0-sun-1:1.6.0.22-1jpp.1.el4 | 1.6.0-sun-1:1.6.0.22-1jpp.1.el4 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.6-1jpp.2.el4 | 1.4.2-ibm-0:1.4.2.13.6-1jpp.2.el4 |
| redhat/java | <1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4 | 1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4 |
| redhat/java | <1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4 | 1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4 |
| redhat/httpd22 | <0:2.2.10-25.1.ep5.el4 | 0:2.2.10-25.1.ep5.el4 |
| redhat/glassfish-jsf | <0:1.2_13-2.ep5.el4 | 0:1.2_13-2.ep5.el4 |
| redhat/httpd22 | <0:2.2.14-4.ep5.el4 | 0:2.2.14-4.ep5.el4 |
| redhat/jakarta-commons-chain | <0:1.2-2.1.ep5.el4 | 0:1.2-2.1.ep5.el4 |
| redhat/jakarta-commons-digester | <0:1.8.1-7.ep5.el4 | 0:1.8.1-7.ep5.el4 |
| redhat/jakarta-commons-io | <0:1.4-1.ep5.el4 | 0:1.4-1.ep5.el4 |
| redhat/jakarta-commons-modeler | <0:2.0-3.3.ep5.el4 | 0:2.0-3.3.ep5.el4 |
| redhat/jakarta-commons-validator | <0:1.3.1-7.4.ep5.el4 | 0:1.3.1-7.4.ep5.el4 |
| redhat/jakarta-oro | <0:2.0.8-3jpp.ep1.3.ep5.el4 | 0:2.0.8-3jpp.ep1.3.ep5.el4 |
| redhat/jboss-javaee | <0:5.0.1-2.3.ep5.el4 | 0:5.0.1-2.3.ep5.el4 |
| redhat/struts12 | <0:1.2.9-2.ep5.el4 | 0:1.2.9-2.ep5.el4 |
| redhat/tomcat5 | <0:5.5.28-7.ep5.el4 | 0:5.5.28-7.ep5.el4 |
| redhat/tomcat6 | <0:6.0.24-2.ep5.el4 | 0:6.0.24-2.ep5.el4 |
| redhat/tomcat-native | <0:1.1.19-2.0.ep5.el4 | 0:1.1.19-2.0.ep5.el4 |
| redhat/xerces-j2 | <0:2.9.1-2.2_patch_01.ep5.el4 | 0:2.9.1-2.2_patch_01.ep5.el4 |
| redhat/xml-commons-resolver12 | <1:1.2-1.1.ep5.el4 | 1:1.2-1.1.ep5.el4 |
| redhat/openssl | <0:0.9.7a-43.17.el4_8.5 | 0:0.9.7a-43.17.el4_8.5 |
| redhat/nspr | <0:4.8.4-1.1.el4_8 | 0:4.8.4-1.1.el4_8 |
| redhat/nss | <0:3.12.6-1.el4_8 | 0:3.12.6-1.el4_8 |
| redhat/gnutls | <0:1.0.20-4.el4_8.7 | 0:1.0.20-4.el4_8.7 |
| redhat/httpd | <0:2.2.3-31.el5_4.2 | 0:2.2.3-31.el5_4.2 |
| redhat/openssl | <0:0.9.8e-12.el5_4.6 | 0:0.9.8e-12.el5_4.6 |
| redhat/openssl097a | <0:0.9.7a-9.el5_4.2 | 0:0.9.7a-9.el5_4.2 |
| redhat/nspr | <0:4.8.4-1.el5_4 | 0:4.8.4-1.el5_4 |
| redhat/nss | <0:3.12.6-1.el5_4 | 0:3.12.6-1.el5_4 |
| redhat/gnutls | <0:1.4.1-3.el5_4.8 | 0:1.4.1-3.el5_4.8 |
| redhat/java | <1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5 | 1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5 |
| redhat/java | <1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5 | 1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5 |
| redhat/java | <1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0 | 1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0 |
| redhat/java | <1.6.0-ibm-1:1.6.0.9.0-1jpp.4.el6 | 1.6.0-ibm-1:1.6.0.9.0-1jpp.4.el6 |
| redhat/rhev-hypervisor | <0:5.4-2.1.12.1.el5_4 | 0:5.4-2.1.12.1.el5_4 |
| redhat/httpd | <0:2.2.10-11.ep5.el5 | 0:2.2.10-11.ep5.el5 |
| redhat/glassfish-jsf | <0:1.2_13-3.ep5.el5 | 0:1.2_13-3.ep5.el5 |
| redhat/httpd | <0:2.2.14-1.2.1.ep5.el5 | 0:2.2.14-1.2.1.ep5.el5 |
| redhat/jakarta-commons-chain | <0:1.2-2.1.1.ep5.el5 | 0:1.2-2.1.1.ep5.el5 |
| redhat/jakarta-commons-io | <0:1.4-1.1.ep5.el5 | 0:1.4-1.1.ep5.el5 |
| redhat/jakarta-oro | <0:2.0.8-3.1.ep5.el5 | 0:2.0.8-3.1.ep5.el5 |
| redhat/struts12 | <0:1.2.9-2.ep5.el5 | 0:1.2.9-2.ep5.el5 |
| redhat/tomcat5 | <0:5.5.28-7.1.ep5.el5 | 0:5.5.28-7.1.ep5.el5 |
| redhat/tomcat6 | <0:6.0.24-2.1.ep5.el5 | 0:6.0.24-2.1.ep5.el5 |
| redhat/tomcat-native | <0:1.1.19-2.0.1.ep5.el5 | 0:1.1.19-2.0.1.ep5.el5 |
| redhat/java | <1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5 | 1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5 |
| redhat/aether | <0:1.13.1-13.el7 | 0:1.13.1-13.el7 |
| redhat/ant | <0:1.9.2-9.el7 | 0:1.9.2-9.el7 |
| redhat/aopalliance | <0:1.0-8.el7 | 0:1.0-8.el7 |
| redhat/apache-commons-codec-eap6 | <0:1.4-16.redhat_3.1.ep6.el7 | 0:1.4-16.redhat_3.1.ep6.el7 |
| redhat/apache-commons-net | <0:3.2-8.el7 | 0:3.2-8.el7 |
| redhat/apache-ivy | <0:2.3.0-4.el7 | 0:2.3.0-4.el7 |
| redhat/apache-mime4j | <0:0.6-10.redhat_3.1.ep6.el7 | 0:0.6-10.redhat_3.1.ep6.el7 |
| redhat/apache-parent | <0:10-14.el7 | 0:10-14.el7 |
| redhat/apache-resource-bundles | <0:2-11.el7 | 0:2-11.el7 |
| redhat/atinject | <0:1-13.20100611svn86.el7 | 0:1-13.20100611svn86.el7 |
| redhat/bouncycastle | <0:1.46-7.el7 | 0:1.46-7.el7 |
| redhat/bsf | <0:2.4.0-19.el7 | 0:2.4.0-19.el7 |
| redhat/c3p0 | <0:0.9.1.2-3.ep6.el7 | 0:0.9.1.2-3.ep6.el7 |
| redhat/candlepin | <0:0.9.49.3-1.el7 | 0:0.9.49.3-1.el7 |
| redhat/candlepin-common | <0:1.0.22-1.el7 | 0:1.0.22-1.el7 |
| redhat/candlepin-guice | <0:3.0-2_redhat_1.el7 | 0:3.0-2_redhat_1.el7 |
| redhat/candlepin-scl | <0:1-5.el7 | 0:1-5.el7 |
| redhat/candlepin-scl-quartz | <0:2.1.5-6.el7 | 0:2.1.5-6.el7 |
| redhat/candlepin-scl-rhino | <0:1.7R3-3.el7 | 0:1.7R3-3.el7 |
| redhat/cdi-api | <0:1.0-11.SP4.el7 | 0:1.0-11.SP4.el7 |
| redhat/cglib | <0:2.2-18.el7 | 0:2.2-18.el7 |
| redhat/elasticsearch | <0:0.90.10-7.el7 | 0:0.90.10-7.el7 |
| redhat/facter | <1:1.7.6-2.1.el7 | 1:1.7.6-2.1.el7 |
| redhat/fasterxml-oss-parent | <0:11-2.ep6.el7 | 0:11-2.ep6.el7 |
| redhat/felix-framework | <0:4.2.1-5.el7 | 0:4.2.1-5.el7 |
| redhat/foreman | <0:1.7.2.33-1.el7 | 0:1.7.2.33-1.el7 |
| redhat/foreman-proxy | <0:1.7.2.5-1.el7 | 0:1.7.2.5-1.el7 |
| redhat/foreman-selinux | <0:1.7.2.13-1.el7 | 0:1.7.2.13-1.el7 |
| redhat/gettext-commons | <0:0.9.6-7.el7 | 0:0.9.6-7.el7 |
| redhat/gofer | <0:2.6.2-2.el7 | 0:2.6.2-2.el7 |
| redhat/google-guice | <0:3.1.3-9.el7 | 0:3.1.3-9.el7 |
| redhat/gperftools | <0:2.0-3.el7 | 0:2.0-3.el7 |
| redhat/groovy | <0:1.8.9-7.el7 | 0:1.8.9-7.el7 |
| redhat/guava | <0:13.0-6.el7 | 0:13.0-6.el7 |
| redhat/gutterball | <0:1.0.15.0-1.el7 | 0:1.0.15.0-1.el7 |
| redhat/hawtjni | <0:1.6-9.el7 | 0:1.6-9.el7 |
| redhat/hfsplus-tools | <0:332.14-12.el7 | 0:332.14-12.el7 |
| redhat/hibernate3-commons-annotations | <0:4.0.1-5.Final_redhat_2.1.ep6.el7.3 | 0:4.0.1-5.Final_redhat_2.1.ep6.el7.3 |
| redhat/hibernate4 | <0:4.2.7-6.SP2_redhat_1.1.ep6.el7 | 0:4.2.7-6.SP2_redhat_1.1.ep6.el7 |
| redhat/hibernate4-validator | <0:4.3.1-1.Final_redhat_1.1.ep6.el7.4 | 0:4.3.1-1.Final_redhat_1.1.ep6.el7.4 |
| redhat/hibernate-beanvalidation-api | <0:1.0.0-4.7.GA_redhat_2.ep6.el7.3 | 0:1.0.0-4.7.GA_redhat_2.ep6.el7.3 |
| redhat/hibernate-jpa | <2.0-api-0:1.0.1-5.Final_redhat_2.1.ep6.el7.4 | 2.0-api-0:1.0.1-5.Final_redhat_2.1.ep6.el7.4 |
| redhat/hiera | <0:1.3.1-2.el7 | 0:1.3.1-2.el7 |
| redhat/hornetq | <0:2.3.14-1.Final_redhat_1.1.ep6.el7 | 0:2.3.14-1.Final_redhat_1.1.ep6.el7 |
| redhat/ipxe | <0:20130517-7.1fm.gitc4bce43.el7 | 0:20130517-7.1fm.gitc4bce43.el7 |
| redhat/jackson-annotations | <0:2.3.0-3.ep6.el7 | 0:2.3.0-3.ep6.el7 |
| redhat/jackson-core | <0:2.3.0-1.ep6.el7 | 0:2.3.0-1.ep6.el7 |
| redhat/jackson-databind | <0:2.3.0-2.ep6.el7 | 0:2.3.0-2.ep6.el7 |
| redhat/jackson-datatype-hibernate | <0:2.3.0-1.ep6.el7 | 0:2.3.0-1.ep6.el7 |
| redhat/jackson-jaxrs-providers | <0:2.3.0-5.ep6.el7 | 0:2.3.0-5.ep6.el7 |
| redhat/jackson-module-jaxb-annotations | <0:2.3.0-2.ep6.el7 | 0:2.3.0-2.ep6.el7 |
| redhat/janino | <0:2.6.1-2.el7 | 0:2.6.1-2.el7 |
| redhat/jansi | <0:1.9-7.el7 | 0:1.9-7.el7 |
| redhat/jansi-native | <0:1.4-10.el7 | 0:1.4-10.el7 |
| redhat/jboss-ejb | <3.1-api-0:1.0.2-10.el7 | 3.1-api-0:1.0.2-10.el7 |
| redhat/jboss-el | <2.2-api-0:1.0.1-0.7.20120212git2fabd8.el7 | 2.2-api-0:1.0.1-0.7.20120212git2fabd8.el7 |
| redhat/jboss-interceptors | <1.1-api-0:1.0.2-0.9.20120319git49a904.el7 | 1.1-api-0:1.0.2-0.9.20120319git49a904.el7 |
| redhat/jboss-jaxrpc | <1.1-api-0:1.0.1-7.el7 | 1.1-api-0:1.0.1-7.el7 |
| redhat/jboss-logging | <0:3.1.4-1.GA_redhat_1.1.ep6.el7 | 0:3.1.4-1.GA_redhat_1.1.ep6.el7 |
| redhat/jboss-parent | <0:14-2.el7 | 0:14-2.el7 |
| redhat/jboss-servlet | <3.0-api-0:1.0.1-9.el7 | 3.0-api-0:1.0.1-9.el7 |
| redhat/jboss-specs-parent | <0:1.0.0-0.7.Beta2.el7 | 0:1.0.0-0.7.Beta2.el7 |
| redhat/jboss-transaction | <1.1-api-0:1.0.1-8.el7 | 1.1-api-0:1.0.1-8.el7 |
| redhat/jsch | <0:0.1.50-5.el7 | 0:0.1.50-5.el7 |
| redhat/jsoup | <0:1.6.1-10.el7 | 0:1.6.1-10.el7 |
| redhat/jsr | <305-0:0-0.18.20090319svn.el7 | 305-0:0-0.18.20090319svn.el7 |
| redhat/jsr | <311-0:1.1.1-6.el7 | 311-0:1.1.1-6.el7 |
| redhat/jzlib | <0:1.1.1-6.el7 | 0:1.1.1-6.el7 |
| redhat/katello | <0:2.2.0.14-1.el7 | 0:2.2.0.14-1.el7 |
| redhat/katello-agent | <0:2.2.5-1.el7 | 0:2.2.5-1.el7 |
| redhat/katello-certs-tools | <0:2.2.1-1.el7 | 0:2.2.1-1.el7 |
| redhat/katello-installer-base | <0:2.3.17-1.el7 | 0:2.3.17-1.el7 |
| redhat/katello-utils | <0:2.2.5-1.el7 | 0:2.2.5-1.el7 |
| redhat/libdb | <0:5.3.21-17.el7_0.1 | 0:5.3.21-17.el7_0.1 |
| redhat/liquibase | <0:3.1.0-1.el7 | 0:3.1.0-1.el7 |
| redhat/livecd-tools | <1:20.4-1.5.el7 | 1:20.4-1.5.el7 |
| redhat/logback | <0:1.0.13-6.el7 | 0:1.0.13-6.el7 |
| redhat/lucene4 | <0:4.6.1-1.el7 | 0:4.6.1-1.el7 |
| redhat/maven | <0:3.0.5-16.el7 | 0:3.0.5-16.el7 |
| redhat/maven2 | <0:2.2.1-47.el7 | 0:2.2.1-47.el7 |
| redhat/maven-artifact-resolver | <1:1.0-10.el7 | 1:1.0-10.el7 |
| redhat/maven-common-artifact-filters | <0:1.4-11.el7 | 0:1.4-11.el7 |
| redhat/maven-compiler-plugin | <0:3.1-4.el7 | 0:3.1-4.el7 |
| redhat/maven-file-management | <1:1.2.1-8.el7 | 1:1.2.1-8.el7 |
| redhat/maven-filtering | <0:1.1-3.el7 | 0:1.1-3.el7 |
| redhat/maven-invoker | <0:2.1.1-9.el7 | 0:2.1.1-9.el7 |
| redhat/maven-parent | <0:20-5.el7 | 0:20-5.el7 |
| redhat/maven-release | <0:2.2.1-12.el7 | 0:2.2.1-12.el7 |
| redhat/maven-remote-resources-plugin | <0:1.4-7.el7 | 0:1.4-7.el7 |
| redhat/maven-scm | <0:1.8.1-2.el7 | 0:1.8.1-2.el7 |
| redhat/maven-shared-incremental | <0:1.1-6.el7 | 0:1.1-6.el7 |
| redhat/maven-shared-io | <1:1.1-7.el7 | 1:1.1-7.el7 |
| redhat/maven-shared-utils | <0:0.4-3.el7 | 0:0.4-3.el7 |
| redhat/maven-wagon | <0:2.4-3.el7 | 0:2.4-3.el7 |
| redhat/modello | <0:1.7-4.el7 | 0:1.7-4.el7 |
| redhat/mongodb | <0:2.4.9-3.el7 | 0:2.4.9-3.el7 |
| redhat/nekohtml | <0:1.9.14-13.el7 | 0:1.9.14-13.el7 |
| redhat/netty | <0:3.6.7-1.Final_redhat_1.1.ep6.el7 | 0:3.6.7-1.Final_redhat_1.1.ep6.el7 |
| redhat/oauth | <0:20100601-5.el7 | 0:20100601-5.el7 |
| redhat/objectweb-asm | <0:3.3.1-9.el7 | 0:3.3.1-9.el7 |
| redhat/openscap | <0:1.2.4-1.el7 | 0:1.2.4-1.el7 |
| redhat/plexus-build-api | <0:0.0.7-11.el7 | 0:0.0.7-11.el7 |
| redhat/plexus-cipher | <0:1.7-5.el7 | 0:1.7-5.el7 |
| redhat/plexus-classworlds | <0:2.4.2-8.el7 | 0:2.4.2-8.el7 |
| redhat/plexus-compiler | <0:2.2-7.el7 | 0:2.2-7.el7 |
| redhat/plexus-component-api | <0:1.0-0.16.alpha15.el7 | 0:1.0-0.16.alpha15.el7 |
| redhat/plexus-containers | <0:1.5.5-14.el7 | 0:1.5.5-14.el7 |
| redhat/plexus-interactivity | <0:1.0-0.14.alpha6.el7 | 0:1.0-0.14.alpha6.el7 |
| redhat/plexus-interpolation | <0:1.15-8.el7 | 0:1.15-8.el7 |
| redhat/plexus-resources | <0:1.0-0.15.a7.el7 | 0:1.0-0.15.a7.el7 |
| redhat/plexus-sec-dispatcher | <0:1.4-13.el7 | 0:1.4-13.el7 |
| redhat/plexus-utils | <0:3.0.9-9.el7 | 0:3.0.9-9.el7 |
| redhat/plexus-velocity | <0:1.1.8-16.el7 | 0:1.1.8-16.el7 |
| redhat/pulp | <0:2.6.0.15-1.el7 | 0:2.6.0.15-1.el7 |
| redhat/pulp-docker | <0:0.2.5-1.el7 | 0:0.2.5-1.el7 |
| redhat/pulp-katello | <0:0.5-1.el7 | 0:0.5-1.el7 |
| redhat/pulp-puppet | <0:2.6.0.15-1.el7 | 0:2.6.0.15-1.el7 |
| redhat/pulp-rpm | <0:2.6.0.15-1.el7 | 0:2.6.0.15-1.el7 |
| redhat/puppet | <0:3.6.2-4.el7 | 0:3.6.2-4.el7 |
| redhat/puppetlabs-stdlib | <0:4.2.1-1.20140510git08b00d9.el7 | 0:4.2.1-1.20140510git08b00d9.el7 |
| redhat/python-amqp | <0:1.4.6-1.el7 | 0:1.4.6-1.el7 |
| redhat/python-anyjson | <0:0.3.3-5.el7 | 0:0.3.3-5.el7 |
| redhat/python-billiard | <1:3.3.0.17-1.el7 | 1:3.3.0.17-1.el7 |
| redhat/python-blinker | <0:1.3-2.el7 | 0:1.3-2.el7 |
| redhat/python-celery | <0:3.1.11-1.el7 | 0:3.1.11-1.el7 |
| redhat/python-cherrypy | <0:3.2.2-3.el7 | 0:3.2.2-3.el7 |
| redhat/python-crane | <0:0.2.2-1.el7 | 0:0.2.2-1.el7 |
| redhat/python-flask | <1:0.10.1-4.el7 | 1:0.10.1-4.el7 |
| redhat/python-httplib2 | <0:0.6.0-6.el7 | 0:0.6.0-6.el7 |
| redhat/python-isodate | <0:0.5.0-4.pulp.el7 | 0:0.5.0-4.pulp.el7 |
| redhat/python-itsdangerous | <0:0.23-1.el7 | 0:0.23-1.el7 |
| redhat/python-jinja2 | <0:2.7.2-2.el7 | 0:2.7.2-2.el7 |
| redhat/python-kombu | <1:3.0.24-10.pulp.el7 | 1:3.0.24-10.pulp.el7 |
| redhat/python-mongoengine | <0:0.7.10-2.el7 | 0:0.7.10-2.el7 |
| redhat/python-nectar | <0:1.3.1-2.el7 | 0:1.3.1-2.el7 |
| redhat/python-oauth2 | <0:1.5.211-8.el7 | 0:1.5.211-8.el7 |
| redhat/python-okaara | <0:1.0.32-1.el7 | 0:1.0.32-1.el7 |
| redhat/python-pymongo | <0:2.5.2-3.el7 | 0:2.5.2-3.el7 |
| redhat/python-qpid | <0:0.30-6.el7 | 0:0.30-6.el7 |
| redhat/python-requests | <0:2.4.3-1.el7 | 0:2.4.3-1.el7 |
| redhat/python-semantic-version | <0:2.2.0-3.el7 | 0:2.2.0-3.el7 |
| redhat/python-simplejson | <0:3.2.0-1.el7 | 0:3.2.0-1.el7 |
| redhat/python-webpy | <0:0.37-3.el7 | 0:0.37-3.el7 |
| redhat/python-werkzeug | <0:0.9.1-1.el7 | 0:0.9.1-1.el7 |
| redhat/qpid-cpp | <0:0.30-9.el7 | 0:0.30-9.el7 |
| redhat/qpid-dispatch | <0:0.4-7.el7 | 0:0.4-7.el7 |
| redhat/qpid-java | <0:0.30-3.el7 | 0:0.30-3.el7 |
| redhat/qpid-proton | <0:0.9-4.el7 | 0:0.9-4.el7 |
| redhat/qpid-qmf | <0:0.30-5.el7 | 0:0.30-5.el7 |
| redhat/qpid-tools | <0:0.30-4.el7 | 0:0.30-4.el7 |
| redhat/resteasy | <0:2.3.8-4.Final_redhat_3.1.ep6.el7 | 0:2.3.8-4.Final_redhat_3.1.ep6.el7 |
| redhat/ruby193-facter | <0:1.6.18-5.el7 | 0:1.6.18-5.el7 |
| redhat/ruby193-rubygem-addressable | <0:2.3.5-2.el7 | 0:2.3.5-2.el7 |
| redhat/ruby193-rubygem-algebrick | <0:0.4.0-3.el7 | 0:0.4.0-3.el7 |
| redhat/ruby193-rubygem-ancestry | <0:2.0.0-1.el7 | 0:2.0.0-1.el7 |
| redhat/ruby193-rubygem-anemone | <0:0.7.2-11.el7 | 0:0.7.2-11.el7 |
| redhat/ruby193-rubygem-angular-rails-templates | <0:0.1.2-1.el7 | 0:0.1.2-1.el7 |
| redhat/ruby193-rubygem-ansi | <0:1.4.3-3.el7 | 0:1.4.3-3.el7 |
| redhat/ruby193-rubygem-apipie-params | <0:0.0.3-2.el7 | 0:0.0.3-2.el7 |
| redhat/ruby193-rubygem-apipie-rails | <0:0.2.5-1.el7 | 0:0.2.5-1.el7 |
| redhat/ruby193-rubygem-archive-tar-minitar | <0:0.5.2-9.el7 | 0:0.5.2-9.el7 |
| redhat/ruby193-rubygem-audited | <0:3.0.0-5.el7 | 0:3.0.0-5.el7 |
| redhat/ruby193-rubygem-audited-activerecord | <0:3.0.0-8.el7 | 0:3.0.0-8.el7 |
| redhat/ruby193-rubygem-autoparse | <0:0.3.3-2.el7 | 0:0.3.3-2.el7 |
| redhat/ruby193-rubygem-bastion | <0:0.3.0.10-1.el7 | 0:0.3.0.10-1.el7 |
| redhat/ruby193-rubygem-commonjs | <0:0.2.7-1.el7 | 0:0.2.7-1.el7 |
| redhat/ruby193-rubygem-daemons | <0:1.1.4-10.el7 | 0:1.1.4-10.el7 |
| redhat/ruby193-rubygem-deface | <0:0.7.2-7.el7 | 0:0.7.2-7.el7 |
| redhat/ruby193-rubygem-docker-api | <0:1.17.0-1.1.el7 | 0:1.17.0-1.1.el7 |
| redhat/ruby193-rubygem-dynflow | <0:0.7.7.9-1.el7 | 0:0.7.7.9-1.el7 |
| redhat/ruby193-rubygem-excon | <0:0.38.0-1.el7 | 0:0.38.0-1.el7 |
| redhat/ruby193-rubygem-extlib | <0:0.9.16-2.el7 | 0:0.9.16-2.el7 |
| redhat/ruby193-rubygem-faraday | <0:0.8.8-2.el7 | 0:0.8.8-2.el7 |
| redhat/ruby193-rubygem-ffi | <0:1.9.3-3.el7 | 0:1.9.3-3.el7 |
| redhat/ruby193-rubygem-fog | <0:1.24.0-3.el7 | 0:1.24.0-3.el7 |
| redhat/ruby193-rubygem-fog-brightbox | <0:0.0.1-2.el7 | 0:0.0.1-2.el7 |
| redhat/ruby193-rubygem-fog-core | <0:1.24.0-1.el7 | 0:1.24.0-1.el7 |
| redhat/ruby193-rubygem-fog-json | <0:1.0.0-2.1.el7 | 0:1.0.0-2.1.el7 |
| redhat/ruby193-rubygem-fog-radosgw | <0:0.0.3-1.el7 | 0:0.0.3-1.el7 |
| redhat/ruby193-rubygem-fog-sakuracloud | <0:0.1.1-1.el7 | 0:0.1.1-1.el7 |
| redhat/ruby193-rubygem-fog-softlayer | <0:0.3.9-1.el7 | 0:0.3.9-1.el7 |
| redhat/ruby193-rubygem-fog-xml | <0:0.1.0-1.el7 | 0:0.1.0-1.el7 |
| redhat/ruby193-rubygem-foreigner | <0:1.4.2-1.el7 | 0:1.4.2-1.el7 |
| redhat/ruby193-rubygem-foreman-tasks | <0:0.6.15.4-1.el7 | 0:0.6.15.4-1.el7 |
| redhat/ruby193-rubygem-formatador | <0:0.2.1-9.el7 | 0:0.2.1-9.el7 |
| redhat/ruby193-rubygem-google-api-client | <0:0.6.4-2.el7 | 0:0.6.4-2.el7 |
| redhat/ruby193-rubygem-haml | <0:3.1.6-6.el7 | 0:3.1.6-6.el7 |
| redhat/ruby193-rubygem-haml-rails | <0:0.3.4-8.el7 | 0:0.3.4-8.el7 |
| redhat/ruby193-rubygem-hashr | <0:0.0.22-5.el7 | 0:0.0.22-5.el7 |
| redhat/ruby193-rubygem-hooks | <0:0.2.2-7.el7 | 0:0.2.2-7.el7 |
| redhat/ruby193-rubygem-hpricot | <0:0.8.6-11.el7 | 0:0.8.6-11.el7 |
| redhat/ruby193-rubygem-ipaddress | <0:0.8.0-6.el7 | 0:0.8.0-6.el7 |
| redhat/ruby193-rubygem-jquery-ui-rails | <0:4.0.2-8.el7 | 0:4.0.2-8.el7 |
| redhat/ruby193-rubygem-justified | <0:0.0.4-4.el7 | 0:0.0.4-4.el7 |
| redhat/ruby193-rubygem-jwt | <0:0.1.8-2.el7 | 0:0.1.8-2.el7 |
| redhat/ruby193-rubygem-katello | <0:2.2.0.65-1.el7 | 0:2.2.0.65-1.el7 |
| redhat/ruby193-rubygem-launchy | <0:2.3.0-2.el7 | 0:2.3.0-2.el7 |
| redhat/ruby193-rubygem-less | <0:2.5.1-2.1.el7 | 0:2.5.1-2.1.el7 |
| redhat/ruby193-rubygem-less-rails | <0:2.5.0-1.el7 | 0:2.5.0-1.el7 |
| redhat/ruby193-rubygem-little-plugger | <0:1.1.3-17.el7 | 0:1.1.3-17.el7 |
| redhat/ruby193-rubygem-logging | <0:1.8.1-26.el7 | 0:1.8.1-26.el7 |
| redhat/ruby193-rubygem-multipart-post | <0:1.2.0-3.el7 | 0:1.2.0-3.el7 |
| redhat/ruby193-rubygem-net-ldap | <0:0.3.1-3.el7 | 0:0.3.1-3.el7 |
| redhat/ruby193-rubygem-net-scp | <0:1.1.0-5.el7 | 0:1.1.0-5.el7 |
| redhat/ruby193-rubygem-net-ssh | <0:2.6.7-5.el7 | 0:2.6.7-5.el7 |
| redhat/ruby193-rubygem-nokogiri | <0:1.5.11-1.el7 | 0:1.5.11-1.el7 |
| redhat/ruby193-rubygem-oauth | <0:0.4.7-8.el7 | 0:0.4.7-8.el7 |
| redhat/ruby193-rubygem-openscap | <0:0.4.2-2.el7 | 0:0.4.2-2.el7 |
| redhat/ruby193-rubygem-passenger | <0:4.0.18-19.el7 | 0:4.0.18-19.el7 |
| redhat/ruby193-rubygem-pg | <0:0.12.2-10.el7 | 0:0.12.2-10.el7 |
| redhat/ruby193-rubygem-rabl | <0:0.9.0-1.el7 | 0:0.9.0-1.el7 |
| redhat/ruby193-rubygem-rbovirt | <0:0.0.29-1.el7 | 0:0.0.29-1.el7 |
| redhat/ruby193-rubygem-rbvmomi | <0:1.6.0-3.el7 | 0:1.6.0-3.el7 |
| redhat/ruby193-rubygem-rest-client | <0:1.6.7-1.el7 | 0:1.6.7-1.el7 |
| redhat/ruby193-rubygem-robotex | <0:1.0.0-16.el7 | 0:1.0.0-16.el7 |
| redhat/ruby193-rubygem-ruby2ruby | <0:2.0.1-9.el7 | 0:2.0.1-9.el7 |
| redhat/ruby193-rubygem-ruby-libvirt | <0:0.5.1-1.el7 | 0:0.5.1-1.el7 |
| redhat/ruby193-rubygem-runcible | <0:1.3.5-1.el7 | 0:1.3.5-1.el7 |
| redhat/ruby193-rubygem-safemode | <0:1.2.1-1.el7 | 0:1.2.1-1.el7 |
| redhat/ruby193-rubygem-sass | <0:3.2.13-1.el7 | 0:3.2.13-1.el7 |
| redhat/ruby193-rubygem-scaptimony | <0:0.3.0.1-1.el7 | 0:0.3.0.1-1.el7 |
| redhat/ruby193-rubygem-sequel | <0:3.45.0-6.el7 | 0:3.45.0-6.el7 |
| redhat/ruby193-rubygem-signet | <0:0.4.5-2.el7 | 0:0.4.5-2.el7 |
| redhat/ruby193-rubygem-sprockets | <0:2.10.1-3.el7 | 0:2.10.1-3.el7 |
| redhat/ruby193-rubygem-sshkey | <0:1.6.0-3.el7 | 0:1.6.0-3.el7 |
| redhat/ruby193-rubygem-tire | <0:0.6.2-1.el7 | 0:0.6.2-1.el7 |
| redhat/ruby193-rubygem-trollop | <0:2.0-5.el7 | 0:2.0-5.el7 |
| redhat/ruby193-rubygem-unf | <0:0.1.3-4.el7 | 0:0.1.3-4.el7 |
| redhat/ruby193-rubygem-uuidtools | <0:2.1.3-6.el7 | 0:2.1.3-6.el7 |
| redhat/ruby193-rubygem-wicked | <0:1.1.0-1.el7 | 0:1.1.0-1.el7 |
| redhat/ruby193-ruby-wrapper | <0:0.0.2-6.el7 | 0:0.0.2-6.el7 |
| redhat/ruby-augeas | <0:0.5.0-1.el7 | 0:0.5.0-1.el7 |
| redhat/rubygem-ansi | <0:1.4.3-3.el7 | 0:1.4.3-3.el7 |
| redhat/rubygem-apipie-bindings | <0:0.0.11-1.el7 | 0:0.0.11-1.el7 |
| redhat/rubygem-clamp | <0:0.6.2-2.el7 | 0:0.6.2-2.el7 |
| redhat/rubygem-fastercsv | <0:1.5.4-10.el7 | 0:1.5.4-10.el7 |
| redhat/rubygem-ffi | <0:1.4.0-3.el7 | 0:1.4.0-3.el7 |
| redhat/rubygem-gssapi | <0:1.1.2-4.el7 | 0:1.1.2-4.el7 |
| redhat/rubygem-hashie | <0:2.0.5-2.el7 | 0:2.0.5-2.el7 |
| redhat/rubygem-highline | <0:1.6.21-1.el7 | 0:1.6.21-1.el7 |
| redhat/rubygem-kafo | <0:0.6.5.9-1.el7 | 0:0.6.5.9-1.el7 |
| redhat/rubygem-little-plugger | <0:1.1.3-17.el7 | 0:1.1.3-17.el7 |
| redhat/rubygem-locale | <0:2.0.9-7.el7 | 0:2.0.9-7.el7 |
| redhat/rubygem-logging | <0:1.8.1-26.el7 | 0:1.8.1-26.el7 |
| redhat/rubygem-mime-types | <0:1.19-7.el7 | 0:1.19-7.el7 |
| redhat/rubygem-oauth | <0:0.4.7-8.el7 | 0:0.4.7-8.el7 |
| redhat/rubygem-passenger | <0:4.0.18-19.el7 | 0:4.0.18-19.el7 |
| redhat/rubygem-powerbar | <0:1.0.11-8.el7 | 0:1.0.11-8.el7 |
| redhat/rubygem-rack | <1:1.4.1-13.el7 | 1:1.4.1-13.el7 |
| redhat/rubygem-rack-protection | <0:1.5.0-7.el7 | 0:1.5.0-7.el7 |
| redhat/rubygem-rake | <0:0.9.2.2-41.el7 | 0:0.9.2.2-41.el7 |
| redhat/rubygem-rb-readline | <0:0.5.1-1.el7 | 0:0.5.1-1.el7 |
| redhat/rubygem-rest-client | <0:1.6.7-1.el7 | 0:1.6.7-1.el7 |
| redhat/rubygem-rkerberos | <0:0.1.2-3.el7 | 0:0.1.2-3.el7 |
| redhat/rubygem-rubyipmi | <0:0.10.0-1.el7 | 0:0.10.0-1.el7 |
| redhat/rubygem-satyr | <0:0.2-1.el7 | 0:0.2-1.el7 |
| redhat/rubygem-sinatra | <1:1.3.6-27.el7 | 1:1.3.6-27.el7 |
| redhat/rubygem-tilt | <0:1.3.3-18.el7 | 0:1.3.3-18.el7 |
| redhat/ruby-rgen | <0:0.6.5-2.el7 | 0:0.6.5-2.el7 |
| redhat/ruby-shadow | <0:1.4.1-21.el7 | 0:1.4.1-21.el7 |
| redhat/saslwrapper | <0:0.22-5.el7 | 0:0.22-5.el7 |
| redhat/sigar | <0:1.6.5-0.9.git58097d9.el7 | 0:1.6.5-0.9.git58097d9.el7 |
| redhat/sisu | <0:2.3.0-11.el7 | 0:2.3.0-11.el7 |
| redhat/snappy-java | <0:1.0.4-2.el7 | 0:1.0.4-2.el7 |
| redhat/v8 | <1:3.14.5.10-11.el7 | 1:3.14.5.10-11.el7 |
| redhat/xbean | <0:3.13-6.el7 | 0:3.13-6.el7 |
| redhat/xpp3 | <0:1.1.3.8-11.el7 | 0:1.1.3.8-11.el7 |
| redhat/xstream | <0:1.3.1-10.el7 | 0:1.3.1-10.el7 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.4.sap-1jpp.1.el4_8 | 1.4.2-ibm-0:1.4.2.13.4.sap-1jpp.1.el4_8 |
| redhat/java | <1.4.2-ibm-sap-0:1.4.2.13.6.sap-1jpp.1.el4_8 | 1.4.2-ibm-sap-0:1.4.2.13.6.sap-1jpp.1.el4_8 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.4.sap-1jpp.1.el5 | 1.4.2-ibm-0:1.4.2.13.4.sap-1jpp.1.el5 |
| redhat/java | <1.4.2-ibm-sap-0:1.4.2.13.6.sap-1jpp.1.el5 | 1.4.2-ibm-sap-0:1.4.2.13.6.sap-1jpp.1.el5 |
| redhat/java | <1.6.0-ibm-1:1.6.0.7-1jpp.2.el5 | 1.6.0-ibm-1:1.6.0.7-1jpp.2.el5 |
| redhat/java | <1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5 | 1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.4-1jpp.1.el5 | 1.4.2-ibm-0:1.4.2.13.4-1jpp.1.el5 |
| redhat/java | <1.6.0-sun-1:1.6.0.19-1jpp.1.el5 | 1.6.0-sun-1:1.6.0.19-1jpp.1.el5 |
| redhat/java | <1.5.0-sun-0:1.5.0.22-1jpp.3.el5 | 1.5.0-sun-0:1.5.0.22-1jpp.3.el5 |
| redhat/java | <1.6.0-sun-1:1.6.0.22-1jpp.1.el5 | 1.6.0-sun-1:1.6.0.22-1jpp.1.el5 |
| redhat/java | <1.4.2-ibm-0:1.4.2.13.6-1jpp.2.el5 | 1.4.2-ibm-0:1.4.2.13.6-1jpp.2.el5 |
| redhat/java | <1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5 | 1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5 |
| redhat/java | <1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5 | 1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5 |
| maven/org.apache.tomcat:tomcat | >=5.0.0<5.5.33 | 5.5.33 |
| maven/org.apache.tomcat:tomcat | >=6.0.0<6.0.32 | 6.0.32 |
| maven/org.apache.tomcat:tomcat | >=7.0.0<7.0.10 | 7.0.10 |
| Apache Http Server | <=2.2.14 | |
| Debian GnuTLS | <=2.8.5 | |
| Mozilla Network Security Services (NSS) | <=3.12.4 | |
| OpenSSL libcrypto | <=0.9.8k | |
| OpenSSL libcrypto | =1.0 | |
| Ubuntu | =8.04 | |
| Ubuntu | =8.10 | |
| Ubuntu | =9.04 | |
| Ubuntu | =9.10 | |
| Ubuntu | =10.04 | |
| Ubuntu | =10.10 | |
| Debian | =4.0 | |
| Debian | =5.0 | |
| Debian | =6.0 | |
| Debian | =7.0 | |
| Debian | =8.0 | |
| Fedora | =11 | |
| Fedora | =12 | |
| Fedora | =13 | |
| Fedora | =14 | |
| F5 NGINX App Protect | >=0.1.0<=0.8.22 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.tombom.co.uk/blog/?p=85
- http://www.ietf.org/mail-archive/web/tls/current/msg03948.html
- http://secunia.com/advisories/37292
- https://bugzilla.mozilla.org/show_bug.cgi?id=526689
- http://extendedsubset.com/?p=8
- http://www.ietf.org/mail-archive/web/tls/current/msg03928.html
- http://www.vupen.com/english/advisories/2009/3165
- http://marc.info/?l=cryptography&m=125752275331877&w=2
- http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during
- http://www.vupen.com/english/advisories/2009/3164
- http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2
- http://kbase.redhat.com/faq/docs/DOC-20491
- https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
- http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html
- http://www.securityfocus.com/bid/36935
- http://www.betanews.com/article/1257452450
- http://www.openwall.com/lists/oss-security/2009/11/06/3
- http://www.openwall.com/lists/oss-security/2009/11/05/3
- https://bugzilla.redhat.com/show_bug.cgi?id=533125
- http://www.links.org/?p=780
- http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html
- http://secunia.com/advisories/37291
- http://www.openwall.com/lists/oss-security/2009/11/05/5
- http://www.openwall.com/lists/oss-security/2009/11/07/3
- http://extendedsubset.com/Renegotiating_TLS.pdf
- http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml
- http://www.securitytracker.com/id?1023163
- http://www.kb.cert.org/vuls/id/120541
- http://www.links.org/?p=789
- http://seclists.org/fulldisclosure/2009/Nov/139
- http://blogs.iss.net/archive/sslmitmiscsrf.html
- http://www.links.org/?p=786
- http://www.vupen.com/english/advisories/2009/3220
- http://support.citrix.com/article/CTX123359
- http://secunia.com/advisories/37320
- http://www.vupen.com/english/advisories/2009/3205
- http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
- http://securitytracker.com/id?1023148
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1
- http://www.debian.org/security/2009/dsa-1934
- http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html
- http://sysoev.ru/nginx/patch.cve-2009-3555.txt
- http://www.openwall.com/lists/oss-security/2009/11/20/1
- http://www.openwall.com/lists/oss-security/2009/11/23/10
- http://wiki.rpath.com/Advisories:rPSA-2009-0155
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html
- http://www.securitytracker.com/id?1023272
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html
- http://www.securitytracker.com/id?1023271
- http://openbsd.org/errata45.html#010_openssl
- http://www.securitytracker.com/id?1023207
- http://secunia.com/advisories/37656
- http://www.securitytracker.com/id?1023211
- http://www.securitytracker.com/id?1023218
- http://www.vupen.com/english/advisories/2009/3353
- http://www.securitytracker.com/id?1023209
- http://www.securitytracker.com/id?1023273
- http://security.gentoo.org/glsa/glsa-200912-01.xml
- http://www.securitytracker.com/id?1023215
- http://www.ingate.com/Relnote.php?ver=481
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html
- http://secunia.com/advisories/37504
- http://www.securitytracker.com/id?1023208
- http://www.securitytracker.com/id?1023212
- http://www.securitytracker.com/id?1023243
- https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html
- http://clicky.me/tlsvuln
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html
- http://www.securitytracker.com/id?1023204
- http://secunia.com/advisories/37501
- http://www.securitytracker.com/id?1023217
- http://www.securitytracker.com/id?1023210
- http://www.securitytracker.com/id?1023274
- http://secunia.com/advisories/37675
- http://www.securitytracker.com/id?1023205
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686
- http://www.securitytracker.com/id?1023275
- http://www.securitytracker.com/id?1023216
- http://openbsd.org/errata46.html#004_openssl
- http://www.securitytracker.com/id?1023270
- http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html
- http://www.securitytracker.com/id?1023206
- http://osvdb.org/60521
- http://www.securitytracker.com/id?1023219
- http://www.vupen.com/english/advisories/2009/3354
- http://secunia.com/advisories/37604
- http://secunia.com/advisories/37859
- http://www.vupen.com/english/advisories/2009/3484
- http://www.vupen.com/english/advisories/2009/3587
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html
- http://www-01.ibm.com/support/docview.wss?uid=swg24025312
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html
- http://secunia.com/advisories/37640
- http://osvdb.org/60972
- http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c
- http://www.vupen.com/english/advisories/2009/3521
- http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html
- http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html
- http://secunia.com/advisories/38056
- http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES
- http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released
- http://support.apple.com/kb/HT4004
- http://secunia.com/advisories/38241
- http://www.vupen.com/english/advisories/2010/0173
- http://secunia.com/advisories/38484
- http://osvdb.org/62210
- http://www.arubanetworks.com/support/alerts/aid-020810.txt
- http://www.vupen.com/english/advisories/2010/0086
- http://secunia.com/advisories/38003
- http://support.avaya.com/css/P8/documents/100070150
- http://www.securitytracker.com/id?1023428
- http://www.securitytracker.com/id?1023427
- http://www.securitytracker.com/id?1023411
- http://www.securitytracker.com/id?1023426
- http://www.redhat.com/support/errata/RHSA-2010-0119.html
- http://secunia.com/advisories/38687
- http://secunia.com/advisories/38020
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1
- http://www.redhat.com/support/errata/RHSA-2010-0167.html
- http://www.redhat.com/support/errata/RHSA-2010-0155.html
- http://www.vupen.com/english/advisories/2010/0748
- http://secunia.com/advisories/39243
- http://secunia.com/advisories/39136
- https://bugzilla.mozilla.org/show_bug.cgi?id=545755
- http://www.mozilla.org/security/announce/2010/mfsa2010-22.html
- http://secunia.com/advisories/39242
- http://www.redhat.com/support/errata/RHSA-2010-0338.html
- http://www.redhat.com/support/errata/RHSA-2010-0339.html
- http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
- http://www.redhat.com/support/errata/RHSA-2010-0337.html
- http://secunia.com/advisories/39317
- http://ubuntu.com/usn/usn-923-1
- http://secunia.com/advisories/39292
- http://secunia.com/advisories/37453
- http://www.securitytracker.com/id?1023224
- http://secunia.com/advisories/37383
- http://secunia.com/advisories/37399
- http://www.vupen.com/english/advisories/2009/3310
- http://www.vupen.com/english/advisories/2009/3313
- http://www.securitytracker.com/id?1023214
- http://www.securitytracker.com/id?1023213
- http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446
- http://www.vupen.com/english/advisories/2010/0848
- http://secunia.com/advisories/38781
- http://secunia.com/advisories/39278
- http://www.redhat.com/support/errata/RHSA-2010-0130.html
- http://www.ubuntu.com/usn/USN-927-1
- http://secunia.com/advisories/39500
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848
- http://www.vupen.com/english/advisories/2010/0982
- http://www-01.ibm.com/support/docview.wss?uid=swg21426108
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:076
- http://www.vupen.com/english/advisories/2010/0933
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
- http://secunia.com/advisories/39628
- http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html
- http://secunia.com/advisories/39461
- http://www.vupen.com/english/advisories/2010/0916
- http://www.mandriva.com/security/advisories?name=MDVSA-2010:089
- http://www.vupen.com/english/advisories/2010/1054
- http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html
- http://support.avaya.com/css/P8/documents/100081611
- http://www.redhat.com/support/errata/RHSA-2010-0165.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html
- http://secunia.com/advisories/39632
- http://secunia.com/advisories/39713
- http://www.vupen.com/english/advisories/2010/0994
- http://marc.info/?l=bugtraq&m=127419602507642&w=2
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html
- http://www.vupen.com/english/advisories/2010/1107
- http://lists.apple.com/archives/security-announce/2010//May/msg00002.html
- http://secunia.com/advisories/39819
- http://lists.apple.com/archives/security-announce/2010//May/msg00001.html
- http://support.apple.com/kb/HT4170
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1
- http://support.apple.com/kb/HT4171
- http://www.vupen.com/english/advisories/2010/1191
- http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html
- http://www.vupen.com/english/advisories/2010/1350
- http://secunia.com/advisories/40070
- http://osvdb.org/65202
- http://www.openoffice.org/security/cves/CVE-2009-3555.html
- http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
- http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1
- http://secunia.com/advisories/39127
- http://www.vupen.com/english/advisories/2010/1639
- http://www.opera.com/support/search/view/944/
- http://www.ubuntu.com/usn/USN-927-5
- http://www.vupen.com/english/advisories/2010/1673
- http://www.opera.com/docs/changelogs/unix/1060/
- http://www.ubuntu.com/usn/USN-927-4
- http://www.vupen.com/english/advisories/2010/1793
- http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751
- http://secunia.com/advisories/40545
- http://secunia.com/advisories/40747
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041
- http://www.vupen.com/english/advisories/2010/2010
- http://secunia.com/advisories/40866
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054
- http://www-01.ibm.com/support/docview.wss?uid=swg21432298
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055
- http://www.us-cert.gov/cas/techalerts/TA10-222A.html
- http://secunia.com/advisories/41490
- http://secunia.com/advisories/41480
- http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995
- http://www.vupen.com/english/advisories/2010/2745
- http://support.avaya.com/css/P8/documents/100114315
- http://support.avaya.com/css/P8/documents/100114327
- http://www.redhat.com/support/errata/RHSA-2010-0770.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
- http://www.us-cert.gov/cas/techalerts/TA10-287A.html
- http://www.ubuntu.com/usn/USN-1010-1
- http://www.redhat.com/support/errata/RHSA-2010-0786.html
- http://secunia.com/advisories/41972
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html
- http://www.redhat.com/support/errata/RHSA-2010-0807.html
- http://secunia.com/advisories/41967
- http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html
- http://www.redhat.com/support/errata/RHSA-2010-0865.html
- http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html
- http://www.redhat.com/support/errata/RHSA-2010-0768.html
- http://www.vupen.com/english/advisories/2010/3086
- http://www-01.ibm.com/support/docview.wss?uid=swg24006386
- http://secunia.com/advisories/42379
- http://secunia.com/advisories/42377
- http://www.securitytracker.com/id?1024789
- http://secunia.com/advisories/42467
- http://www.vupen.com/english/advisories/2010/3126
- http://www.vmware.com/security/advisories/VMSA-2010-0019.html
- http://www.vupen.com/english/advisories/2010/3069
- http://secunia.com/advisories/42811
- http://www.vupen.com/english/advisories/2011/0032
- http://www.debian.org/security/2011/dsa-2141
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html
- http://www.redhat.com/support/errata/RHSA-2010-0986.html
- http://www.redhat.com/support/errata/RHSA-2010-0987.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://secunia.com/advisories/42724
- http://secunia.com/advisories/42816
- http://secunia.com/advisories/42808
- http://secunia.com/advisories/42733
- https://kb.bluecoat.com/index?page=content&id=SA50
- http://www.vupen.com/english/advisories/2011/0033
- http://www.vupen.com/english/advisories/2011/0086
- http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- http://secunia.com/advisories/43308
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- http://secunia.com/advisories/44183
- http://www.redhat.com/support/errata/RHSA-2011-0880.html
- http://marc.info/?l=bugtraq&m=130497311408250&w=2
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html
- http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html
- http://marc.info/?l=bugtraq&m=132077688910227&w=2
- http://secunia.com/advisories/44954
- http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html
- http://www.securityfocus.com/archive/1/522176
- http://security.gentoo.org/glsa/glsa-201203-22.xml
- http://secunia.com/advisories/48577
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html
- http://security.gentoo.org/glsa/glsa-201406-32.xml
- http://www.openssl.org/news/secadv_20091111.txt
- http://secunia.com/advisories/41818
- http://marc.info/?l=bugtraq&m=142660345230545&w=2
- http://www.debian.org/security/2015/dsa-3253
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- http://marc.info/?l=bugtraq&m=127128920008563&w=2
- http://marc.info/?l=bugtraq&m=134254866602253&w=2
- http://marc.info/?l=bugtraq&m=127557596201693&w=2
- http://marc.info/?l=bugtraq&m=126150535619567&w=2
- http://marc.info/?l=bugtraq&m=133469267822771&w=2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54158
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088
- http://www.securityfocus.com/archive/1/516397/100/0/threaded
- http://www.securityfocus.com/archive/1/515055/100/0/threaded
- http://www.securityfocus.com/archive/1/508130/100/0/threaded
- http://www.securityfocus.com/archive/1/508075/100/0/threaded
- http://www.securityfocus.com/archive/1/507952/100/0/threaded
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049
- https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E
- http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00014.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c2
- http://cvs.openssl.org/chngview?cn=18790
- https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.xml
- http://www.ietf.org/mail-archive/web/tls/current/msg03963.html
- https://bugzilla.mozilla.org/show_bug.cgi?id=524596
- http://djm.net.au/2009/11/6/ssh-is-not-vulnerable-to-the-ssl-tls-mitm-attack
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=367773&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=367773&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c4
- http://marc.info/?l=openssl-dev&m=125744015832463&w=2
- http://cvs.openssl.org/chngview?cn=18791
- http://cvs.openssl.org/chngview?cn=18794
- http://cvs.openssl.org/chngview?cn=18795
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c10
- http://svn.apache.org/viewvc?view=revision&revision=833622
- http://www.apache.org/dist/httpd/patches/apply_to_2.2.14/CVE-2009-3555-2.2.patch
- http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00043.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c24
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c12
- https://rhn.redhat.com/errata/RHSA-2009-1580.html
- https://rhn.redhat.com/errata/RHSA-2009-1579.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c23
- http://www.phonefactor.com/sslgap/ssl-tls-authentication-patches
- http://svn.apache.org/viewvc?view=revision&revision=835322
- http://svn.apache.org/viewvc?view=revision&revision=835335
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c42
- http://markmail.org/thread/jmpsjhz3fy6mivv3
- https://access.redhat.com/security/cve/CVE-2009-3555
- http://tomcat.apache.org/security-5.html#Not%20a%20vulnerability%20in%20Tomcat
- http://tomcat.apache.org/security-6.html#Not%20a%20vulnerability%20in%20Tomcat
- https://rhn.redhat.com/errata/RHSA-2010-0011.html
- http://admin.fedoraproject.org/updates/nss-3.12.5-3.fc11
- http://www.ietf.org/id/draft-ietf-tls-renegotiation-03.txt
- http://www.ietf.org/mail-archive/web/tls/current/msg05563.html
- http://www.iana.org/assignments/tls-parameters/
- http://www.iana.org/assignments/tls-extensiontype-values/
- http://admin.fedoraproject.org/updates/nss-3.12.5-8.fc12
- https://ssltls.de/
- https://www.mikestoolbox.net/
- http://www-01.ibm.com/support/docview.wss?uid=nas258cbfcf0a5645af7862576710041f65e
- https://rhn.redhat.com/errata/RHSA-2009-1694.html
- http://www.ibm.com/developerworks/java/jdk/alerts/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c38
- http://tomcat.apache.org/security-native.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c45
- http://svn.apache.org/viewvc?view=revision&revision=884998
- http://svn.apache.org/viewvc?view=revision&revision=881774
- http://www.ietf.org/mail-archive/web/ietf-announce/current/msg07034.html
- http://www.rfc-editor.org/rfc/rfc5746.txt
- http://admin.fedoraproject.org/updates/proftpd-1.3.2d-1.el5
- http://admin.fedoraproject.org/updates/proftpd-1.3.2d-1.el4
- https://rhn.redhat.com/errata/RHSA-2010-0119.html
- http://marc.info/?l=openssl-dev&m=126712103527093&w=2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c77
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=397463&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=397463&action=edit
- https://rhn.redhat.com/errata/RHSA-2010-0130.html
- http://admin.fedoraproject.org/updates/nss-3.12.6-1.2.fc12
- http://admin.fedoraproject.org/updates/nss-3.12.6-1.2.fc11
- http://admin.fedoraproject.org/updates/nss-3.12.6-1.2.fc13
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=572876
- https://rhn.redhat.com/errata/RHSA-2010-0155.html
- http://admin.fedoraproject.org/updates/openssl-0.9.8m-1.fc11
- https://bugzilla.mozilla.org/show_bug.cgi?id=554594
- https://rhn.redhat.com/errata/RHSA-2010-0162.html
- https://rhn.redhat.com/errata/RHSA-2010-0163.html
- https://rhn.redhat.com/errata/RHSA-2010-0164.html
- https://rhn.redhat.com/errata/RHSA-2010-0165.html
- https://rhn.redhat.com/errata/RHSA-2010-0166.html
- https://rhn.redhat.com/errata/RHSA-2010-0167.html
- http://admin.fedoraproject.org/updates/openssl-0.9.8n-1.fc11
- http://admin.fedoraproject.org/updates/openssl-1.0.0-1.fc12
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=533125#c60
- http://java.sun.com/javase/javaseforbusiness/docs/TLSReadme.html
- https://rhn.redhat.com/errata/RHSA-2010-0339.html
- https://rhn.redhat.com/errata/RHSA-2010-0337.html
- https://rhn.redhat.com/errata/RHSA-2010-0338.html
- http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-34.b17.fc11
- http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc12
- http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-36.b17.fc13
- http://admin.fedoraproject.org/updates/java-1.6.0-openjdk-1.6.0.0-37.b17.fc13
- https://developer.mozilla.org/NSS_3.12.6_release_notes
- https://rhn.redhat.com/errata/RHSA-2010-0408.html
- http://admin.fedoraproject.org/updates/openssl-1.0.0-4.fc12
- https://rhn.redhat.com/errata/RHSA-2010-0440.html
- http://admin.fedoraproject.org/updates/gnutls-2.8.6-2.fc13
- http://admin.fedoraproject.org/updates/gnutls-2.8.6-2.fc12
- https://rhn.redhat.com/errata/RHSA-2010-0768.html
- https://rhn.redhat.com/errata/RHSA-2010-0770.html
- http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html
- https://rhn.redhat.com/errata/RHSA-2010-0786.html
- https://rhn.redhat.com/errata/RHSA-2010-0807.html
- http://www.ibm.com/developerworks/java/jdk/security/50/secguides/jsse2Docs/JSSE2_RFC5746.html
- http://www-01.ibm.com/support/docview.wss?uid=swg1IZ75870
- https://rhn.redhat.com/errata/RHSA-2010-0865.html
- https://rhn.redhat.com/errata/RHSA-2010-0986.html
- https://rhn.redhat.com/errata/RHSA-2010-0987.html
- https://rhn.redhat.com/errata/RHSA-2011-0880.html
- https://www.cve.org/CVERecord?id=CVE-2009-3555 https://nvd.nist.gov/vuln/detail/CVE-2009-3555
- https://access.redhat.com/errata/RHSA-2010:0155
- https://access.redhat.com/errata/RHSA-2010:0786
- https://access.redhat.com/errata/RHSA-2009:1694
- https://access.redhat.com/errata/RHSA-2010:0130
- https://access.redhat.com/errata/RHSA-2010:0337
- https://access.redhat.com/errata/RHSA-2010:0338
- https://access.redhat.com/errata/RHSA-2010:0770
- https://access.redhat.com/errata/RHSA-2010:0807
- https://access.redhat.com/errata/RHSA-2010:0987
- https://access.redhat.com/errata/RHSA-2010:0011
- https://access.redhat.com/errata/RHSA-2010:0119
- https://access.redhat.com/errata/RHSA-2009:1579
- https://access.redhat.com/errata/RHSA-2010:0163
- https://access.redhat.com/errata/RHSA-2009:1580
- https://access.redhat.com/errata/RHSA-2010:0165
- https://access.redhat.com/errata/RHSA-2010:0167
- https://access.redhat.com/errata/RHSA-2010:0162
- https://access.redhat.com/errata/RHSA-2010:0164
- https://access.redhat.com/errata/RHSA-2010:0166
- https://access.redhat.com/errata/RHSA-2010:0339
- https://access.redhat.com/errata/RHSA-2010:0768
- https://access.redhat.com/errata/RHSA-2010:0865
- https://access.redhat.com/errata/RHSA-2010:0440
- https://access.redhat.com/errata/RHSA-2011:0880
- https://access.redhat.com/errata/RHSA-2015:1591
- https://access.redhat.com/errata/RHSA-2010:0408
- https://access.redhat.com/errata/RHSA-2010:0986
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2009-3555.json
- https://nvd.nist.gov/vuln/detail/CVE-2009-3555
- https://github.com/apache/tomcat/commit/14e4efd925da58b9fa63f20969fb7349b8a9c30d
- https://github.com/apache/tomcat/commit/2d4ca03acc27cc883c404d1745d92f983b6fada3
- https://github.com/apache/tomcat/commit/30af3f5630542a2340781f66553e734a6fd69701
- https://github.com/apache/tomcat/commit/328a523cbb2a2d4cd55283180614d4e03e2f8f02
- https://github.com/apache/tomcat/commit/3d315ac9dfaa2c03b4df82938d78bf5b755766b3
- https://github.com/apache/tomcat/commit/56f67141e82e16f68a860c3af9b7342da35cbe7d
- https://github.com/apache/tomcat/commit/b4e9488629bf03b4b65abf335e536e85386d1366
- https://github.com/apache/tomcat/commit/df9633116b5fec8f47f1f008fb89a6e9d5895cd0
- https://bz.apache.org/bugzilla/show_bug.cgi?id=50325
- https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d@<dev.tomcat.apache.org>
- https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2@<dev.tomcat.apache.org>
- https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220@<dev.tomcat.apache.org>
- https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d@<dev.tomcat.apache.org>
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10088
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11578
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11617
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7315
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7478
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7973
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8366
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8535
- https://tomcat.apache.org/security-5.html
- https://tomcat.apache.org/security-6.html
- https://tomcat.apache.org/security-7.html
- http://www.opera.com/docs/changelogs/unix/1060
- http://www.opera.com/support/search/view/944
- https://github.com/advisories/GHSA-f7w7-6pjc-wwm6 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
- RHSA-2010:0155
- RHSA-2010:0786
- RHSA-2009:1694
- RHSA-2010:0130
- RHSA-2010:0337
- RHSA-2010:0338
- RHSA-2010:0770
- RHSA-2010:0807
- RHSA-2010:0987
- RHSA-2010:0011
- RHSA-2010:0119
- RHSA-2009:1579
- RHSA-2010:0163
- RHSA-2009:1580
- RHSA-2010:0165
- RHSA-2010:0167
- RHSA-2010:0162
- RHSA-2010:0164
- RHSA-2010:0166
- RHSA-2010:0339
- RHSA-2010:0768
- RHSA-2010:0865
- RHSA-2010:0440
- RHSA-2011:0880
- RHSA-2015:1591
- RHSA-2010:0408
- RHSA-2010:0986
Frequently Asked Questions
What is the severity of CVE-2009-3555?
The severity of CVE-2009-3555 is considered high due to its potential for MITM attacks.
How do I fix CVE-2009-3555?
To fix CVE-2009-3555, you should update your TLS/SSL implementations and libraries to the latest versions that address this vulnerability.
What are the potential impacts of CVE-2009-3555?
CVE-2009-3555 can allow an attacker to perform man-in-the-middle attacks, injecting arbitrary data into the secure session.
Which software versions are affected by CVE-2009-3555?
CVE-2009-3555 affects various versions of Java, OpenSSL, and several web servers such as Apache HTTP Server and nginx.
Is CVE-2009-3555 still a relevant vulnerability today?
While CVE-2009-3555 was primarily impactful in the past, many systems have mitigated this vulnerability through updates and patches.
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-3555
- collector/redhat-cve
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-f7w7-6pjc-wwm6
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-historical
- collector/nvd-index
- package-manager/redhat
- package-manager/maven
- vendor/apache
- canonical/apache http server
- version/apache http server/2.2.14
- vendor/gnu
- canonical/debian gnutls
- version/debian gnutls/2.8.5
- vendor/mozilla
- canonical/mozilla network security services (nss)
- version/mozilla network security services (nss)/3.12.4
- vendor/openssl
- canonical/openssl libcrypto
- version/openssl libcrypto/0.9.8k
- version/openssl libcrypto/1.0
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/8.04
- version/ubuntu/8.10
- version/ubuntu/9.04
- version/ubuntu/9.10
- version/ubuntu/10.04
- version/ubuntu/10.10
- vendor/debian
- canonical/debian
- version/debian/4.0
- version/debian/5.0
- version/debian/6.0
- version/debian/7.0
- version/debian/8.0
- vendor/fedoraproject
- canonical/fedora
- version/fedora/11
- version/fedora/12
- version/fedora/13
- version/fedora/14
- vendor/f5
- canonical/f5 nginx app protect
- version/f5 nginx app protect/0.1.0
- version/f5 nginx app protect/0.8.22