{"id":"CVE-2009-2417","aliases":["CURL-CVE-2009-2417","DEBIAN-CVE-2009-2417","DSA-1869-1","EUVD-2009-2413","GHSA-c74q-xg62-9cwm","RHSA-2009:1209","openSUSE-SU-2024:10303-1"],"status":"published","title":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly...","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03461,"percentile":0.89146,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-310"],"published":"2009-08-12T08:00:00Z","modified":"2026-10-25T09:30:05Z","fixes":[{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.19.5-1.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.19.5-1.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.19.5-1.1"],"sources":["osv"]},{"ecosystem":"Debian:4.0","package":"curl","fixed_in":["7.15.5-1etch3"],"sources":["osv"]},{"ecosystem":"Debian:5.0","package":"curl","fixed_in":["7.18.2-8lenny3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-debuginfo","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-devel","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-debuginfo","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-devel","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-debuginfo","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-devel","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-debuginfo","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-devel","fixed_in":["0:7.10.6-10.rhel3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-debuginfo","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-devel","fixed_in":["0:7.12.1-11.1.el4_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-debuginfo","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-devel","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl-debuginfo","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-debuginfo","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-devel","fixed_in":["0:7.15.5-2.1.el5_3.5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.5-1.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.5-1.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.19.5-1.1"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.15.5-1etch3"}]}],"versions":["7.15.5-1","7.15.5-1etch1","7.15.5-1etch2"]},{"source":"osv","ecosystem":"Debian:5.0","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.18.2-8lenny3"}]}],"versions":["7.18.2-8","7.18.2-8lenny2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::as","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::desktop","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::es","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:3::ws","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.10.6-10.rhel3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::as","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::desktop","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::es","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:4::ws","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.12.1-11.1.el4_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client_workstation","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:5::server","package":"curl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.15.5-2.1.el5_3.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.51.0-1.1"}]}],"bundled":32}],"products":[{"vendor":"curl","product":"libcurl"},{"vendor":"libcurl","product":"libcurl"}],"references":[{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/archive/1/506055/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://secunia.com/advisories/37471","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.vupen.com/english/advisories/2009/2263","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-1158-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2009-0016.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/36238","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/52405","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix"]},{"url":"http://wiki.rpath.com/Advisories:rPSA-2009-0124","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.securityfocus.com/archive/1/507985/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://support.apple.com/kb/HT4077","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://shibboleth.internet2.edu/secadv/secadv_20090817.txt","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://secunia.com/advisories/36475","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred","web"]},{"url":"http://curl.haxx.se/docs/adv_20090812.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"http://secunia.com/advisories/45047","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/36032","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"http://www.vupen.com/english/advisories/2009/3316","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2417","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c74q-xg62-9cwm"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-2417","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2009:1209","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=516181","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2009/rhsa-2009_1209.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2009-2417","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-2417","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0249","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2174","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3613","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3144","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3153","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3236","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8617","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8621","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8622","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8623","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8625","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2009-2417","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","status":"published","published":"2009-08-14T15:00:00Z","modified":"2024-08-07T05:52:14.669Z","updated_at":"2026-11-02T14:33:23.395558Z"}],"euvd":[{"id":"EUVD-2009-2413","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","status":"published","published":"2009-08-14T15:00:00Z","modified":"2024-08-07T05:52:14Z","updated_at":"2026-11-03T01:39:17.521372Z"}],"ghsa":[{"id":"GHSA-c74q-xg62-9cwm","title":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly...","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","status":"published","published":"2022-05-02T03:35:01Z","modified":"2023-01-31T05:08:17Z","updated_at":"2026-11-02T14:49:22.342351Z"}],"nvd":[{"id":"CVE-2009-2417","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","status":"published","published":"2009-08-14T15:16:27.39Z","modified":"2026-06-16T23:09:24.55Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:01:36.200173Z"}],"osv":[{"id":"CURL-CVE-2009-2417","title":"embedded zero in cert name","description":"SSL and TLS Server certificates contain one or more fields with server name\nor otherwise matching patterns. These strings are stored as content and\nlength within the certificate, and thus there is no particular terminating\ncharacter.\n\ncurl's OpenSSL interfacing code did faulty assumptions about those names and\npatterns being null-terminated, allowing itself to be fooled in case a\ncertificate would get a zero byte embedded into one of the name fields. To\nillustrate, a name that would show this vulnerability could look like:\n\n  \"example.com\\0.haxx.se\"\n\nThis cert is thus made for \"haxx.se\" but curl would erroneously verify it\nwith no complaints for \"example.com\".\n\nAccording to a recently published presentation, this kind of zero embedding\nhas been proven to be possible with at least one CA.","status":"published","published":"2009-08-12T08:00:00Z","modified":"2026-10-25T09:30:05.367835055Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CVE-2009-2417","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","status":"published","published":"2009-08-14T15:16:27Z","modified":"2026-04-10T03:40:49.782477Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2009-2417","description":"lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.","status":"published","published":"2009-08-14T15:16:27.39Z","modified":"2026-10-23T17:47:42.87871406Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1869-1","title":"curl - SSL certificate verification weakness","status":"published","published":"2009-08-19T00:00:00Z","modified":"2026-03-09T01:18:48.905712Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"openSUSE-SU-2024:10303-1","title":"curl-7.51.0-1.1 on GA media","description":"These are all security issues fixed in the curl-7.51.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:45:23.860668Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2009:1209","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-15T18:05:46Z","modified":"2026-06-26T12:19:11.781153627Z","updated_at":"2026-11-02T15:53:00.468834Z"}]}}