CVE-2009-3291

2009-09-2200:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.012 Low

EPSS

Percentile

84.9%

JSON

The php_openssl_apply_verification_policy function in PHP before 5.2.11
does not properly perform certificate validation, which has unknown impact
and attack vectors, probably related to an ability to spoof certificates.

Bugs

Notes

Author	Note
mdeslaur	NUL (‘\0’) character embedded in X509 certificate’s CommonName or subjectAltName given RH’s analysis of this issue, reprioritizing as “low”

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchphp5< 5.1.2-1ubuntu3.17UNKNOWN
ubuntu8.04noarchphp5< 5.2.4-2ubuntu5.9UNKNOWN
ubuntu8.10noarchphp5< 5.2.6-2ubuntu4.5UNKNOWN
ubuntu9.04noarchphp5< 5.2.6.dfsg.1-3ubuntu4.4UNKNOWN
ubuntu9.10noarchphp5< 5.2.10.dfsg.1-2ubuntu6.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	php5	< 5.1.2-1ubuntu3.17	UNKNOWN
ubuntu	8.04	noarch	php5	< 5.2.4-2ubuntu5.9	UNKNOWN
ubuntu	8.10	noarch	php5	< 5.2.6-2ubuntu4.5	UNKNOWN
ubuntu	9.04	noarch	php5	< 5.2.6.dfsg.1-3ubuntu4.4	UNKNOWN
ubuntu	9.10	noarch	php5	< 5.2.10.dfsg.1-2ubuntu6.3	UNKNOWN