neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Neon | — | Apply OS X security update 2010-007Upgrade macOS to the latest version | Dec 16, 2011 | Aug 21, 2009 |
| Centos_linux | — | Upgrade neonUpgrade neon-devel | Dec 1, 2016 | Aug 21, 2009 |
| Debian | — | Upgrade neon27Upgrade litmus | Jul 30, 2024 | Aug 21, 2009 |
| Oracle_linux | — | Upgrade neon-develUpgrade neon | Oct 16, 2024 | Aug 21, 2009 |
| Suse | — | Upgrade libneon-develUpgrade libneon27-x86Upgrade libneon27-32bitUpgrade libneon27Upgrade neon | Aug 9, 2024 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libneon25Upgrade libneon27Upgrade libneon27-gnutls | Nov 8, 2024 | Aug 21, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
