{"id":"CVE-2009-3555","published":"2009-11-09T17:00:00Z","modified":"2026-05-27T15:38:56Z","title":"The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.","provenance":"source","from":"CVE.org"},"summary":{"text":"The TLS protocol and SSL 3.0 (and possibly earlier), as implemented in Microsoft IIS 7.0, Apache mod_ssl 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla NSS 3.12.4 and earlier, and multiple Cisco products, fail to properly bind renegotiation handshakes to the existing connection. A man-in-the-middle attacker can exploit this by sending an unauthenticated request that the server processes retroactively in a post-renegotiation context, allowing data to be injected into HTTPS and other TLS- or SSL-protected sessions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.87264,"percentile":0.9975,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2009-11-18","exploitedFirstSeen":"2009-11-18","ransomware":false,"evidence":[{"url":"https://packetstormsecurity.com/files/82770/SUSE-Security-Announcement-SUSE-SA-2009-057.html","date":"2009-11-18"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":3,"pulses":[{"name":"Oracle Java Technologies | Oracle","url":"https://otx.alienvault.com/pulse/684623a3ee04506229bf6a1f","created":"2025-06-08"},{"name":"UPX executable packer.","url":"https://otx.alienvault.com/pulse/663d2869e0f3a42bbddc42ff","created":"2024-05-09"},{"name":"Internal CVE Research","url":"https://otx.alienvault.com/pulse/6228b4f0b2d5ade72cc7a0ea","created":"2022-03-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-300","name":"Channel Accessible by Non-Endpoint"}],"references":[{"url":"http://lists.apple.com/archives/security-announce/2010//May/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://www.securitytracker.com/id?1023427","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://support.avaya.com/css/P8/documents/100081611","tags":["x_refsource_CONFIRM"]},{"url":"http://osvdb.org/62210","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://secunia.com/advisories/37640","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.arubanetworks.com/support/alerts/aid-020810.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2010/0916","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://support.avaya.com/css/P8/documents/100114327","tags":["x_refsource_CONFIRM"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0167.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.vupen.com/english/advisories/2010/2010","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2010/0086","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2010/1673","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.ietf.org/mail-archive/web/tls/current/msg03948.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/37656","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0865.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/39628","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/42724","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2009/3310","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2009/3205","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/39461","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://support.avaya.com/css/P8/documents/100114315","tags":["x_refsource_CONFIRM"]},{"url":"http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c","tags":["x_refsource_CONFIRM"]},{"url":"http://security.gentoo.org/glsa/glsa-201406-32.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.ingate.com/Relnote.php?ver=481","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id?1023204","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/40866","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=134254866602253&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-222A.html","tags":["third-party-advisory","x_refsource_CERT"]},{"url":"http://www.securitytracker.com/id?1023211","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/39317","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securitytracker.com/id?1023212","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/39127","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/40545","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2010/3069","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://openbsd.org/errata45.html#010_openssl","tags":["vendor-advisory","x_refsource_OPENBSD"]},{"url":"http://www.securitytracker.com/id?1023210","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.securitytracker.com/id?1023270","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/40070","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securitytracker.com/id?1023273","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://kbase.redhat.com/faq/docs/DOC-20491","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-927-5","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:089","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0770.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.openssl.org/news/secadv_20091111.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id?1023275","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.debian.org/security/2015/dsa-3253","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.vupen.com/english/advisories/2009/3484","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.securitytracker.com/id?1023207","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/37859","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=142660345230545&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1","tags":["vendor-advisory","x_refsource_SUNALERT"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2010/0848","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.openwall.com/lists/oss-security/2009/11/07/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/39819","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://www.links.org/?p=786","tags":["x_refsource_MISC"]},{"url":"http://osvdb.org/60521","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://www.openwall.com/lists/oss-security/2009/11/23/10","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.kb.cert.org/vuls/id/120541","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"http://www.securitytracker.com/id?1023217","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0768.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.vupen.com/english/advisories/2009/3353","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/39136","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.openoffice.org/security/cves/CVE-2009-3555.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2011/0032","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://securitytracker.com/id?1023148","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.securityfocus.com/bid/36935","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://www.tombom.co.uk/blog/?p=85","tags":["x_refsource_MISC"]},{"url":"http://marc.info/?l=bugtraq&m=130497311408250&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.vupen.com/english/advisories/2010/1107","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.securitytracker.com/id?1023218","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.vupen.com/english/advisories/2010/1350","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0338.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/42379","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://www.securitytracker.com/id?1023213","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2010/1793","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://extendedsubset.com/?p=8","tags":["x_refsource_MISC"]},{"url":"http://secunia.com/advisories/37292","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/522176","tags":["vendor-advisory","x_refsource_HP"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/54158","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://lists.apple.com/archives/security-announce/2010//May/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://secunia.com/advisories/39278","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securitytracker.com/id?1023205","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0130.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html","tags":["x_refsource_CONFIRM"]},{"url":"http://support.apple.com/kb/HT4004","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id?1023215","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.ubuntu.com/usn/USN-1010-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securitytracker.com/id?1023206","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888","tags":["x_refsource_CONFIRM"]},{"url":"http://security.gentoo.org/glsa/glsa-200912-01.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://marc.info/?l=bugtraq&m=127419602507642&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.vupen.com/english/advisories/2009/3313","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1","tags":["vendor-advisory","x_refsource_SUNALERT"]},{"url":"http://www.securitytracker.com/id?1023208","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/43308","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securitytracker.com/id?1023214","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://secunia.com/advisories/38781","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=133469267822771&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.debian.org/security/2009/dsa-1934","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.securitytracker.com/id?1023271","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html","tags":["vendor-advisory","x_refsource_APPLE"]},{"url":"http://marc.info/?l=cryptography&m=125752275331877&w=2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/42467","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/508130/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.securitytracker.com/id?1023224","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.ubuntu.com/usn/USN-927-4","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://secunia.com/advisories/41490","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/508075/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securitytracker.com/id?1023243","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html","tags":["x_refsource_MISC"]},{"url":"http://secunia.com/advisories/37504","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.securitytracker.com/id?1023219","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://sysoev.ru/nginx/patch.cve-2009-3555.txt","tags":["x_refsource_CONFIRM"]},{"url":"http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id?1023163","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://marc.info/?l=bugtraq&m=132077688910227&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.vupen.com/english/advisories/2009/3521","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released","tags":["x_refsource_CONFIRM"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=533125","tags":["x_refsource_CONFIRM"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://secunia.com/advisories/44183","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/42808","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/39500","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2009/3220","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://marc.info/?l=bugtraq&m=127557596201693&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0165.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/archive/1/515055/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0987.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=545755","tags":["x_refsource_CONFIRM"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21426108","tags":["x_refsource_CONFIRM"]},{"url":"http://blogs.iss.net/archive/sslmitmiscsrf.html","tags":["x_refsource_MISC"]},{"url":"http://www.securitytracker.com/id?1023411","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0339.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0986.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.vupen.com/english/advisories/2009/3164","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/37383","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/44954","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.ietf.org/mail-archive/web/tls/current/msg03928.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://support.avaya.com/css/P8/documents/100070150","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/40747","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://marc.info/?l=bugtraq&m=126150535619567&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://secunia.com/advisories/39292","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/42816","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1","tags":["vendor-advisory","x_refsource_SUNALERT"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg21432298","tags":["x_refsource_CONFIRM"]},{"url":"http://extendedsubset.com/Renegotiating_TLS.pdf","tags":["x_refsource_MISC"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg24025312","tags":["x_refsource_CONFIRM"]},{"url":"http://www-01.ibm.com/support/docview.wss?uid=swg24006386","tags":["x_refsource_CONFIRM"]},{"url":"http://support.apple.com/kb/HT4170","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/507952/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://www.securitytracker.com/id?1023209","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only","tags":["vendor-advisory","x_refsource_AIXAPAR"]},{"url":"http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/48577","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446","tags":["vendor-advisory","x_refsource_SLACKWARE"]},{"url":"http://www.links.org/?p=789","tags":["x_refsource_MISC"]},{"url":"http://www.opera.com/docs/changelogs/unix/1060/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html","tags":["x_refsource_MISC"]},{"url":"http://www.redhat.com/support/errata/RHSA-2011-0880.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2009/11/06/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2009-0155","tags":["x_refsource_CONFIRM"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://support.citrix.com/article/CTX123359","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/37501","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:076","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://marc.info/?l=bugtraq&m=127128920008563&w=2","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://www.vupen.com/english/advisories/2009/3587","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/39632","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/38687","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=526689","tags":["x_refsource_MISC"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049","tags":["vendor-advisory","x_refsource_MS"]},{"url":"http://www.vupen.com/english/advisories/2010/0982","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/37399","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.ubuntu.com/usn/USN-927-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://www.securitytracker.com/id?1023272","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2010/3126","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/37320","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2009/3165","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2010/1639","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/38020","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://ubuntu.com/usn/usn-923-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://secunia.com/advisories/39243","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://secunia.com/advisories/37453","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.vupen.com/english/advisories/2010/0933","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2011-0003.html","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/41972","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2010/3086","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.debian.org/security/2011/dsa-2141","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://www.securitytracker.com/id?1024789","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0155.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html","tags":["x_refsource_MISC"]},{"url":"http://www.vupen.com/english/advisories/2011/0033","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0337.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securitytracker.com/id?1023216","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/41480","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2011/0086","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/41818","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/37604","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.opera.com/support/search/view/944/","tags":["x_refsource_CONFIRM"]},{"url":"http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA10-287A.html","tags":["third-party-advisory","x_refsource_CERT"]},{"url":"http://www.links.org/?p=780","tags":["x_refsource_MISC"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0119.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://secunia.com/advisories/38056","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2010/0748","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://secunia.com/advisories/37675","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535","tags":["vdb-entry","signature","x_refsource_OVAL"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2010-0019.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0786.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt","tags":["x_refsource_MISC"]},{"url":"http://secunia.com/advisories/38003","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://support.apple.com/kb/HT4171","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securitytracker.com/id?1023428","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://www.openwall.com/lists/oss-security/2009/11/20/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.vupen.com/english/advisories/2009/3354","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.securitytracker.com/id?1023274","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://secunia.com/advisories/39242","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://kb.bluecoat.com/index?page=content&id=SA50","tags":["x_refsource_CONFIRM"]},{"url":"http://secunia.com/advisories/38241","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/42377","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://security.gentoo.org/glsa/glsa-201203-22.xml","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://www.openwall.com/lists/oss-security/2009/11/05/3","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://osvdb.org/60972","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://www.securitytracker.com/id?1023426","tags":["vdb-entry","x_refsource_SECTRACK"]},{"url":"http://secunia.com/advisories/38484","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2010:084","tags":["vendor-advisory","x_refsource_MANDRIVA"]},{"url":"http://www.betanews.com/article/1257452450","tags":["x_refsource_MISC"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1","tags":["vendor-advisory","x_refsource_SUNALERT"]},{"url":"http://www.mozilla.org/security/announce/2010/mfsa2010-22.html","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/516397/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://openbsd.org/errata46.html#004_openssl","tags":["vendor-advisory","x_refsource_OPENBSD"]},{"url":"http://secunia.com/advisories/41967","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2010-0807.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.vupen.com/english/advisories/2010/1191","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://seclists.org/fulldisclosure/2009/Nov/139","tags":["mailing-list","x_refsource_FULLDISC"]},{"url":"https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html","tags":["x_refsource_MISC"]},{"url":"http://www.openwall.com/lists/oss-security/2009/11/05/5","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://secunia.com/advisories/39713","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/42733","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://secunia.com/advisories/37291","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.vupen.com/english/advisories/2010/2745","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1","tags":["vendor-advisory","x_refsource_SUNALERT"]},{"url":"http://www.vupen.com/english/advisories/2010/0994","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2010/0173","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://www.vupen.com/english/advisories/2010/1054","tags":["vdb-entry","x_refsource_VUPEN"]},{"url":"http://osvdb.org/65202","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041","tags":["vendor-advisory","x_refsource_HP"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html","tags":["mailing-list","x_refsource_BUGTRAQ"]},{"url":"http://clicky.me/tlsvuln","tags":["x_refsource_MISC"]},{"url":"http://secunia.com/advisories/42811","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.exploit-db.com/exploits/10579","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.0, <7.0.10",">=6.0.0, <6.0.32",">=5.0.0, <5.5.33"],"patched":["7.0.10","6.0.32","5.5.33"],"from":["GHSA-f7w7-6pjc-wwm6"],"provenance":"source"}],"advisories":[{"id":"GHSA-f7w7-6pjc-wwm6","url":"https://github.com/advisories/GHSA-f7w7-6pjc-wwm6","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=7.0.0, <7.0.10"],"patched":["7.0.10"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f7w7-6pjc-wwm6","url":"https://github.com/advisories/GHSA-f7w7-6pjc-wwm6","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=6.0.0, <6.0.32"],"patched":["6.0.32"],"provenance":"source","from":"GHSA"},{"id":"GHSA-f7w7-6pjc-wwm6","url":"https://github.com/advisories/GHSA-f7w7-6pjc-wwm6","severity":"CRITICAL","ecosystem":"Maven","package":"org.apache.tomcat:tomcat","vulnerableRanges":[">=5.0.0, <5.5.33"],"patched":["5.5.33"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-3720","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-3720","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":10071,"url":"https://www.exploit-db.com/exploits/10071","title":"Mozilla NSS - NULL Character CA SSL Certificate Validation Security Bypass","type":"remote","platform":"multiple","date":"2009-11-10","verified":true,"provenance":"source"},{"id":10579,"url":"https://www.exploit-db.com/exploits/10579","title":"TLS - Renegotiation","type":"remote","platform":"multiple","date":"2009-12-21","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2009-11-10"},"pocGithub":{"count":1,"skipped":0,"earliest":"2022-03-30","earliestUrl":"https://github.com/johnwchadwick/cve-2009-3555-test-server","repos":[{"name":"johnwchadwick/cve-2009-3555-test-server","url":"https://github.com/johnwchadwick/cve-2009-3555-test-server","stars":3,"created":"2022-03-30"}]},"first":{"date":"2009-11-10","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/10071"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/10579"],"flow":[],"timeline":[{"date":"2009-11-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2009-3555","provenance":"source"},{"date":"2009-11-10","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-10071); later: PoC-in-GitHub 2022-03-30","url":"https://www.exploit-db.com/exploits/10071","provenance":"source"},{"date":"2009-11-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://packetstormsecurity.com/files/82770/SUSE-Security-Announcement-SUSE-SA-2009-057.html","provenance":"source"}],"speed":{"daysToPublicExploit":1,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 6189 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}