CVE-2009-3766

muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2009-3766

CVE-2009-3766 affects mutt 1.5.16 and earlier (before 1.5.19) when using OpenSSL: the code in mutt_ssl.c does not verify the certificate CN against the server hostname, enabling MITM spoofing with arbitrary certificates. This is supported by connected OpenVAS/MIRACLE_LINUX references noting the s...