Skip to content
Fencer Vulns
medium 5.1

CVE-2009-2409 json

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k;…

published 2009-07-30 17 y ago modified 2026-06-16 4 mo ago also EUVD-2009-2405

cvss
5.1
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.3%
EPSS 4.3% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Patch / fix

  • gnu gnutls 2.6.4, 2.7.4
  • mozilla network_security_services 3.12.3
  • nss Debian 14, Debian 13, Debian 12 3.12.3-1
  • openssl Debian 14, Debian 13, Debian 12 0.9.8k-4

debian advisories DEBIAN-CVE-2009-2409

  • java-1.5.0-sun RHEL 4 EXTRAS, network satellite 5.1 1.5.0.22-1jpp.1.el4
  • java-1.6.0-openjdk RHEL 5 1:1.6.0.0-1.7.b09.el5
  • java-1.6.0-openjdk-src RHEL 5 1:1.6.0.0-1.7.b09.el5
  • java-1.6.0-openjdk-demo RHEL 5 1:1.6.0.0-1.7.b09.el5
  • java-1.6.0-openjdk-javadoc RHEL 5 1:1.6.0.0-1.7.b09.el5
  • java-1.5.0-sun RHEL 5 EXTRAS 1.5.0.22-1jpp.1.el5
  • java-1.5.0-sun-src RHEL 4 EXTRAS 1.5.0.22-1jpp.1.el4
  • java-1.5.0-sun-src RHEL 5 EXTRAS 1.5.0.22-1jpp.1.el5

red hat advisories RHSA-2009:1662RHSA-2009:1584RHSA-2009:1571RHSA-2009:1560RHSA-2010:0054RHSA-2009:1432

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2009-2409 updated cvss 2.6

deprecate MD2 in SSL cert validation (Kaminsky)

  • Red Hat Desktop version 3 openssl 0.9.7a-33.26, seamonkey 1.0.9-0.45.el3, openssl-perl 0.9.7a-33.26, seamonkey-nss 1.0.9-0.45.el3, seamonkey-chat 1.0.9-0.45.el3, seamonkey-mail 1.0.9-0.45.el3, +3 more
    fixed: vendor fix RHSA-2010:0163
  • Red Hat Desktop version 4 Extras java-1.5.0-sun 1.5.0.22-1jpp.1.el4, java-1.6.0-sun 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-src 1.5.0.22-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-demo 1.5.0.22-1jpp.1.el4, java-1.5.0-sun-jdbc 1.5.0.22-1jpp.1.el4, +4 more
    fixed: vendor fix RHSA-2009:1571
  • Red Hat Enterprise Linux (v. 5 server) nspr 4.7.4-1.el5_3.1, gnutls 1.4.1-3.el5_4.8, nss 3.12.3.99.3-1.el5_3.2, openssl 0.9.8e-12.el5_4.1, gnutls-utils 1.4.1-3.el5_4.8, openssl-perl 0.9.8e-12.el5_4.1, +5 more
    fixed: vendor fix RHSA-2010:0166
  • Red Hat Enterprise Linux AS EUS (v. 4.7) nspr 4.7.4-1.el4_7.1, nss 3.12.3.99.3-1.el4_7.6
    fixed: vendor fix RHSA-2009:1190
  • Red Hat Enterprise Linux AS version 3 openssl 0.9.7a-33.26, seamonkey 1.0.9-0.45.el3, openssl-perl 0.9.7a-33.26, seamonkey-nss 1.0.9-0.45.el3, seamonkey-chat 1.0.9-0.45.el3, seamonkey-mail 1.0.9-0.45.el3, +3 more Red Hat Enterprise Linux AS version 4 nspr 4.7.4-1.el4_8.1, nss 3.12.3.99.3-1.el4_8.2, openssl 0.9.7a-43.17.el4_8.5, nss-tools 3.12.3.99.3-1.el4_8.2, openssl-perl 0.9.7a-43.17.el4_8.5
    fixed: vendor fix RHSA-2010:0163
  • Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-sun 1.5.0.22-1jpp.1.el4, java-1.6.0-sun 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-src 1.5.0.22-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-demo 1.5.0.22-1jpp.1.el4, java-1.5.0-sun-jdbc 1.5.0.22-1jpp.1.el4, +4 more
    fixed: vendor fix RHSA-2009:1571
  • Red Hat Enterprise Linux Desktop (v. 5 client) nspr 4.7.4-1.el5_3.1, gnutls 1.4.1-3.el5_4.8, nss 3.12.3.99.3-1.el5_3.2, openssl 0.9.8e-12.el5_4.1, gnutls-utils 1.4.1-3.el5_4.8, openssl-perl 0.9.8e-12.el5_4.1, +5 more
    fixed: vendor fix RHSA-2010:0166
  • Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-sun 1.5.0.22-1jpp.1.el5, java-1.6.0-sun 1.6.0.17-1jpp.2.el5, java-1.5.0-sun-src 1.5.0.22-1jpp.1.el5, java-1.6.0-sun-src 1.6.0.17-1jpp.2.el5, java-1.5.0-sun-demo 1.5.0.22-1jpp.1.el5, java-1.5.0-sun-jdbc 1.5.0.22-1jpp.1.el5, +4 more
    fixed: vendor fix RHSA-2009:1571
show 10 more
  • Red Hat Enterprise Linux Desktop version 4 nspr 4.7.4-1.el4_8.1, nss 3.12.3.99.3-1.el4_8.2, openssl 0.9.7a-43.17.el4_8.5, nss-tools 3.12.3.99.3-1.el4_8.2, openssl-perl 0.9.7a-43.17.el4_8.5
    fixed: vendor fix RHSA-2010:0163
  • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nspr 4.7.4-1.el5_3.1, gnutls 1.4.1-3.el5_4.8, nss 3.12.3.99.3-1.el5_3.2, openssl 0.9.8e-12.el5_4.1
    fixed: vendor fix RHSA-2010:0166
  • Red Hat Enterprise Linux ES EUS (v. 4.7) nspr 4.7.4-1.el4_7.1, nss 3.12.3.99.3-1.el4_7.6
    fixed: vendor fix RHSA-2009:1190
  • Red Hat Enterprise Linux ES version 3 openssl 0.9.7a-33.26, seamonkey 1.0.9-0.45.el3, openssl-perl 0.9.7a-33.26, seamonkey-nss 1.0.9-0.45.el3, seamonkey-chat 1.0.9-0.45.el3, seamonkey-mail 1.0.9-0.45.el3, +3 more Red Hat Enterprise Linux ES version 4 nspr 4.7.4-1.el4_8.1, nss 3.12.3.99.3-1.el4_8.2, openssl 0.9.7a-43.17.el4_8.5, nss-tools 3.12.3.99.3-1.el4_8.2, openssl-perl 0.9.7a-43.17.el4_8.5
    fixed: vendor fix RHSA-2010:0163
  • Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-sun 1.5.0.22-1jpp.1.el4, java-1.6.0-sun 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-src 1.5.0.22-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-demo 1.5.0.22-1jpp.1.el4, java-1.5.0-sun-jdbc 1.5.0.22-1jpp.1.el4, +4 more
    fixed: vendor fix RHSA-2009:1571
  • Red Hat Enterprise Linux EUS (v. 5.2 server) nspr 4.7.4-1.el5_2, nss 3.12.3.99.3-1.el5_2, nss-tools 3.12.3.99.3-1.el5_2
    fixed: vendor fix RHSA-2009:1207
  • Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-sun 1.5.0.22-1jpp.1.el5, java-1.6.0-sun 1.6.0.17-1jpp.2.el5, java-1.5.0-sun-src 1.5.0.22-1jpp.1.el5, java-1.6.0-sun-src 1.6.0.17-1jpp.2.el5, java-1.5.0-sun-demo 1.5.0.22-1jpp.1.el5, java-1.5.0-sun-jdbc 1.5.0.22-1jpp.1.el5, +4 more
    fixed: vendor fix RHSA-2009:1571
  • Red Hat Enterprise Linux WS version 3 openssl 0.9.7a-33.26, seamonkey 1.0.9-0.45.el3, openssl-perl 0.9.7a-33.26, seamonkey-nss 1.0.9-0.45.el3, seamonkey-chat 1.0.9-0.45.el3, seamonkey-mail 1.0.9-0.45.el3, +3 more Red Hat Enterprise Linux WS version 4 nspr 4.7.4-1.el4_8.1, nss 3.12.3.99.3-1.el4_8.2, openssl 0.9.7a-43.17.el4_8.5, nss-tools 3.12.3.99.3-1.el4_8.2, openssl-perl 0.9.7a-43.17.el4_8.5
    fixed: vendor fix RHSA-2010:0163
  • Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-sun 1.5.0.22-1jpp.1.el4, java-1.6.0-sun 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-src 1.5.0.22-1jpp.1.el4, java-1.6.0-sun-src 1.6.0.17-1jpp.1.el4, java-1.5.0-sun-demo 1.5.0.22-1jpp.1.el4, java-1.5.0-sun-jdbc 1.5.0.22-1jpp.1.el4, +4 more
    fixed: vendor fix RHSA-2009:1571
  • Red Hat Satellite 5.1 (RHEL v.4 AS) java-1.5.0-sun 1.5.0.22-1jpp.1.el4
    fixed: vendor fix RHSA-2009:1662

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.27% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-295 Improper Certificate Validation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.