CVE-2009-3767
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is...
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Exploit likelihood
What each source reports
NVD Score used
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3767- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3767- Updated
- 2026-11-02
EUVDEUVD-2009-3739 No score
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
EUVD-2009-3739- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hc4m-gmh3-4vxp No score
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is...
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
GHSA-hc4m-gmh3-4vxp- Weakness
- CWE-295
- Updated
- 2026-11-02
OSV No score
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3767- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3767 No score
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
DEBIAN-CVE-2009-3767- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openldapDebian:12 |
before 2.4.17-2.1 | 2.4.17-2.1 |
openldapDebian:13 |
before 2.4.17-2.1 | 2.4.17-2.1 |
openldapDebian:14 |
before 2.4.17-2.1 | 2.4.17-2.1 |
openldap2.3Debian:4.0 |
before 2.3.30-5+etch3, plus listed versions 2.3.30-52.3.30-5+etch12.3.30-5+etch2 |
2.3.30-5+etch3 |
openldapDebian:5.0 |
before 2.4.11-1+lenny1, plus listed versions 2.4.11-1 |
2.4.11-1+lenny1 |
openldapRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-debuginfoRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-develRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-serversRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-servers-overlaysRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
Show 41 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openldap-servers-sqlRed Hat:enterprise_linux:5::client_workstation |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
compat-openldapRed Hat:enterprise_linux:5::client |
before 0:2.3.43_2.2.29-12.el5 | 0:2.3.43_2.2.29-12.el5 |
openldapRed Hat:enterprise_linux:5::client |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-clientsRed Hat:enterprise_linux:5::client |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-debuginfoRed Hat:enterprise_linux:5::client |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
compat-openldapRed Hat:enterprise_linux:5::server |
before 0:2.3.43_2.2.29-12.el5 | 0:2.3.43_2.2.29-12.el5 |
openldapRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-clientsRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-debuginfoRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-develRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-serversRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-servers-overlaysRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
openldap-servers-sqlRed Hat:enterprise_linux:5::server |
before 0:2.3.43-12.el5 | 0:2.3.43-12.el5 |
compat-openldapRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.1.30-12.el4_8.3 | 0:2.1.30-12.el4_8.3 |
openldapRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-clientsRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-develRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-serversRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-servers-sqlRed Hat:enterprise_linux:4::as From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
compat-openldapRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.1.30-12.el4_8.3 | 0:2.1.30-12.el4_8.3 |
openldapRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-clientsRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-develRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-serversRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-servers-sqlRed Hat:enterprise_linux:4::desktop From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
compat-openldapRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.1.30-12.el4_8.3 | 0:2.1.30-12.el4_8.3 |
openldapRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-clientsRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-develRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-serversRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-servers-sqlRed Hat:enterprise_linux:4::es From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
compat-openldapRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.1.30-12.el4_8.3 | 0:2.1.30-12.el4_8.3 |
openldapRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-clientsRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-develRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-serversRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
openldap-servers-sqlRed Hat:enterprise_linux:4::ws From an advisory covering 2 CVEs |
before 0:2.2.13-12.el4_8.3 | 0:2.2.13-12.el4_8.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3767 is a medium vulnerability (CVSS 4.3) in Openldap, published October 23, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in openldap 2.4.17-2.1.
References
lists.fedoraproject.org/pipermail/package-announce/2010-March/036138.html
marc.info?l=oss-security&m=125369675820512&w=2
security.gentoo.org/glsa/glsa-201406-36.xml
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11178
vupen.com/english/advisories/2010/1858
secunia.com/advisories/40677
Show 38 moreShow less
openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_o.c.diff?r1=1.8&r2=1.11&f=h
redhat.com/support/errata/RHSA-2010-0543.html
lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
support.apple.com/kb/HT3937
nvd.nist.gov/vuln/detail/CVE-2009-3767
github.com/advisories/GHSA-hc4m-gmh3-4vxp
security-tracker.debian.org/tracker/CVE-2009-3767
access.redhat.com/errata/RHSA-2010:0198
bugzilla.redhat.com/show_bug.cgi?id=104585
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0198.json
cve.org/CVERecord?id=CVE-2009-3767