neon vulnerabilities

2009-09-2100:00:00

ubuntu.com

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

9.3 High

AI Score

Confidence

High

0.02 Low

EPSS

Percentile

89.0%

JSON

Releases

Ubuntu 9.04
Ubuntu 8.10
Ubuntu 8.04
Ubuntu 6.06

Packages

neon -
neon27 -

Details

Joe Orton discovered that neon did not correctly handle SSL certificates
with zero bytes in the Common Name. A remote attacker could exploit this
to perform a machine-in-the-middle attack to view sensitive information or
alter encrypted communications.

OSVersionArchitecturePackageVersionFilename
Ubuntu9.04noarchlibneon27< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu9.04noarchlibneon25-dev< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu9.04noarchlibneon27-dbg< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu9.04noarchlibneon27-dev< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu9.04noarchlibneon27-gnutls< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu9.04noarchlibneon27-gnutls-dbg< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu9.04noarchlibneon27-gnutls-dev< 0.28.2-6.1ubuntu0.1UNKNOWN
Ubuntu8.10noarchlibneon27< 0.28.2-2ubuntu0.1UNKNOWN
Ubuntu8.10noarchlibneon27-dbg< 0.28.2-2ubuntu0.1UNKNOWN
Ubuntu8.10noarchlibneon27-dev< 0.28.2-2ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	9.04	noarch	libneon27	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	9.04	noarch	libneon25-dev	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	9.04	noarch	libneon27-dbg	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	9.04	noarch	libneon27-dev	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	9.04	noarch	libneon27-gnutls	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	9.04	noarch	libneon27-gnutls-dbg	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	9.04	noarch	libneon27-gnutls-dev	< 0.28.2-6.1ubuntu0.1	UNKNOWN
Ubuntu	8.10	noarch	libneon27	< 0.28.2-2ubuntu0.1	UNKNOWN
Ubuntu	8.10	noarch	libneon27-dbg	< 0.28.2-2ubuntu0.1	UNKNOWN
Ubuntu	8.10	noarch	libneon27-dev	< 0.28.2-2ubuntu0.1	UNKNOWN