Unscored severity · published Oct 23, 2009
CVE-2009-3766
mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate,…
–
CVSS
1.1%
EPSS
No
On KEV
Description
mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
Mutt · Mutt
1.5.16 before 1.5.19 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3766
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3766
Patch
http://dev.mutt.org/trac/ticket/3087
Mailing List
http://marc.info/?l=oss-security&m=125198917018936&w=2
Mailing List
http://www.openwall.com/lists/oss-security/2009/10/26/1
More from Mutt
9.8
CVE-2018-14362
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16
9.8
CVE-2018-14359
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16
9.8
CVE-2018-14358
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16
9.8
CVE-2018-14357
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16
9.8
CVE-2018-14356
An issue was discovered in Mutt before 1.10.1 and NeoMutt before 2018-07-16