CVE-2009-2700: src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509…

Unscored severity · published Sep 2, 2009

CVE-2009-2700

src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509…

–

CVSS

0.9%

EPSS

On KEV

Description

src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Exploitation

Is it being used?

Exploit prediction (EPSS)0.9% · higher than 61% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

QT · QT

4.0.0; 4.0.1; 4.1.0; 4.1.1; 4.1.2; 4.1.3; +34 more · source: NVD

Affected product

All QT CVEs