The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Libsecurity | — | Apply OS X security update 2009-006Upgrade macOS to the latest version | Dec 16, 2011 | Jul 30, 2009 |
| Centos_linux | — | Upgrade gnutls-develUpgrade openssl-develUpgrade java-1.6.0-openjdk-demoUpgrade gnutlsUpgrade opensslUpgrade gnutls-utilsUpgrade java-1.6.0-openjdk-javadocUpgrade java-1.6.0-openjdk-develUpgrade openssl-perlUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdk | Dec 1, 2016 | Jul 30, 2009 |
| Debian | — | Upgrade opensslUpgrade nss | Jul 30, 2024 | Jul 30, 2009 |
| Gentoo Linux | — | Upgrade app-emulation/emul-linux-x86-java.Upgrade dev-java/sun-jdk.Upgrade dev-java/blackdown-jdk.Upgrade dev-java/sun-jre-bin.Upgrade dev-libs/openssl.Upgrade dev-java/blackdown-jre. | Oct 30, 2017 | Jul 30, 2009 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Mar 5, 2026 | Jul 30, 2009 |
| Oracle_linux | — | Upgrade nsprUpgrade nspr-develUpgrade nss-pkcs11-develUpgrade gnutlsUpgrade gnutls-utilsUpgrade nss-develUpgrade java-1.6.0-openjdk-demoUpgrade gnutls-develUpgrade openssl-develUpgrade opensslUpgrade java-1.6.0-openjdk-srcUpgrade java-1.6.0-openjdkUpgrade nss-toolsUpgrade java-1.6.0-openjdk-develUpgrade java-1.6.0-openjdk-javadocUpgrade openssl-perlUpgrade nss | Oct 16, 2024 | Jul 30, 2009 |
| Suse | — | Upgrade java-1_6_0-openjdk-srcUpgrade java-1_6_0-openjdkUpgrade java-1_6_0-openjdk-demoUpgrade java-1_6_0-openjdk-pluginUpgrade java-1_6_0-openjdk-develUpgrade java-1_6_0-openjdk-javadoc | Dec 12, 2013 | Jul 30, 2009 |
| Ubuntu | — | Upgrade openjdk-6-jreUpgrade libgnutls12Upgrade icedtea6-pluginUpgrade libssl0.9.8Upgrade libgnutls26Upgrade libnss3-1d | Nov 8, 2024 | Jul 30, 2009 |
| Vmsa 2010 0001 1 Update For Service Console Packages Nss And Nspr | — | Upgrade VMware ESX 4.0 to build number 219382 | Sep 2, 2010 | Jul 30, 2009 |
| Vmsa 2010 0009 1 Service Console Package Openssl | — | Upgrade VMware ESX 4.0 to build number 256968 | Sep 2, 2010 | Jul 30, 2009 |
| Vmsa 2010 0015 | — | Upgrade VMware ESX 4.0 to build number 294855Upgrade VMware ESX 4.1 to build number 320092 | Nov 19, 2010 | Jul 30, 2009 |
| Vmsa 2010 0019 | — | Upgrade VMware ESX 3.5 to build number 317866 | Feb 16, 2011 | Jul 30, 2009 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub