Description
The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nss | 3.12.3-1 | — |
| Debian 14 | openssl | 0.9.8k-4 | — |
| Debian 13 | nss | 3.12.3-1 | — |
| Debian 13 | openssl | 0.9.8k-4 | — |
| Debian 12 | nss | 3.12.3-1 | — |
| Debian 12 | openssl | 0.9.8k-4 | — |
| Debian 5.0 | gnutls26 | 2.4.2-6+lenny2 | DSA-1935-1 |
| Debian 5.0 | nss | 3.12.3.1-0lenny1 | DSA-1874-1 |
| Debian 5.0 | openssl | 0.9.8g-15+lenny5 | DSA-1888-1 |
| Debian 4.0 | gnutls13 | 1.4.4-3+etch5 | DSA-1935-1 |
| Debian 4.0 | openssl | 0.9.8c-4etch9 | DSA-1888-1 |
| Debian 4.0 | openssl097 | 0.9.7k-3.1etch5 | DSA-1888-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | gnutls +2 | 1.4.1-3.el5_4.8 | RHSA-2010:0166 |
| RHEL 5 | java-1.5.0-sun +5 | 1.5.0.22-1jpp.1.el5 | RHSA-2009:1571 |
| RHEL 5 | java-1.6.0-openjdk +4 | 1:1.6.0.0-1.7.b09.el5 | RHSA-2009:1584 |
| RHEL 5 | java-1.6.0-sun +5 | 1:1.6.0.17-1jpp.2.el5 | RHSA-2009:1560 |
| RHEL 5 | nspr +1 | 4.7.4-1.el5_3.1 | RHSA-2009:1186 |
| RHEL 5 | nss +3 | 3.12.3.99.3-1.el5_3.2 | RHSA-2009:1186 |
| RHEL 5 | openssl +2 | 0.9.8e-12.el5_4.1 | RHSA-2010:0054 |
| RHEL 4 | java-1.5.0-sun +5 | 1.5.0.22-1jpp.1.el4 | RHSA-2009:1571 |
| RHEL 4 | java-1.6.0-sun +5 | 1:1.6.0.17-1jpp.1.el4 | RHSA-2009:1560 |
| RHEL 4 | nspr +1 | 4.7.4-1.el4_8.1 | RHSA-2009:1184 |
| RHEL 4 | nss +2 | 3.12.3.99.3-1.el4_8.2 | RHSA-2009:1184 |
| RHEL 4 | openssl +2 | 0.9.7a-43.17.el4_8.5 | RHSA-2010:0163 |
| RHEL 3 | openssl +2 | 0.9.7a-33.26 | RHSA-2010:0163 |
| RHEL 3 | seamonkey +9 | 1.0.9-0.45.el3 | RHSA-2009:1432 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5.2 EUS | nspr +1 | 4.7.4-1.el5_2 | RHSA-2009:1207 |
| RHEL 5.2 EUS | nss +3 | 3.12.3.99.3-1.el5_2 | RHSA-2009:1207 |
| RHEL 4.7 EUS | nspr +1 | 4.7.4-1.el4_7.1 | RHSA-2009:1190 |
| RHEL 4.7 EUS | nss +1 | 3.12.3.99.3-1.el4_7.6 | RHSA-2009:1190 |
| Red Hat Network Satellite 5 | java-1.5.0-sun +1 | 1.5.0.22-1jpp.1.el4 | RHSA-2009:1662 |
Advisories 15
- RHSA-2010:0166 Red Hat Security Advisory: gnutls security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0163 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2010:0054 Red Hat Security Advisory: openssl security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1662 Red Hat Security Advisory: Red Hat Network Satellite Server Sun Java Runtime security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1584 Red Hat Security Advisory: java-1.6.0-openjdk security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1571 Red Hat Security Advisory: java-1.5.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1560 Red Hat Security Advisory: java-1.6.0-sun security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1432 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1207 Red Hat Security Advisory: nspr and nss security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1190 Red Hat Security Advisory: nspr and nss security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1186 Red Hat Security Advisory: nspr and nss security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2009:1184 Red Hat Security Advisory: nspr and nss security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-1935-1 gnutls13 gnutls26 - SSL certificate Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1888-1 openssl - cryptographic weakness Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1874-1 nss - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 36139 third-party-advisory
- 36157 third-party-advisory
- MDVSA-2009:197 vendor-advisory
- MDVSA-2009:216 vendor-advisory
- DSA-1888 vendor-advisory
- oval:org.mitre.oval:def:8594 vdb-entry signature
- GLSA-200911-02 vendor-advisory
- 36434 third-party-advisory
- GLSA-200912-01 vendor-advisory
- 1022631 vdb-entry
- 42467 third-party-advisory
- [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released mailing-list
- RHSA-2009:1207 vendor-advisory
- 20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console mailing-list
- 36669 third-party-advisory
- RHSA-2009:1432 vendor-advisory
- USN-810-1 vendor-advisory
- oval:org.mitre.oval:def:10763 vdb-entry signature
- MDVSA-2009:258 vendor-advisory
- USN-810-2 vendor-advisory
- http://java.sun.com/javase/6/webnotes/6u17.html
- oval:org.mitre.oval:def:7155 vdb-entry signature
- [syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released mailing-list
- ADV-2010-3126 vdb-entry
- RHSA-2010:0095 vendor-advisory
- ADV-2009-3184 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2409
- http://java.sun.com/j2se/1.5.0/ReleaseNotes.html
- http://www.vmware.com/security/advisories/VMSA-2010-0019.html
- oval:org.mitre.oval:def:6631 vdb-entry signature
- APPLE-SA-2009-11-09-1 vendor-advisory
- MDVSA-2010:084 vendor-advisory
- 37386 third-party-advisory
- ADV-2009-2085 vdb-entry
- DSA-1874 vendor-advisory
- 36739 third-party-advisory
- http://support.apple.com/kb/HT3937