CVE-2009-3555: Apache Tomcat Apache Tomcat Affected By Vulnerability Vulnerability

Q: What is CVE-2009-3555?

CVE-2009-3555 is a security vulnerability in Apache Tomcat involving Apache Tomcat affected by vulnerability in TLS and SSL protocol under CWE-295: Improper Certificate Validation.

Q: Which Apache Tomcat versions are affected?

Affected versions include releases prior to 7.0.10, 6.0.32, 5.5.33 across affected packages: org.apache.tomcat:tomcat.

Q: What version fixes CVE-2009-3555?

Upgrading to 7.0.10, 6.0.32, 5.5.33 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is tomcat affected?

Yes, org.apache.tomcat:tomcat is affected in releases prior to 7.0.10, 6.0.32, 5.5.33. Upgrade your dependency to 7.0.10, 6.0.32, 5.5.33 or later.

Q: What is the CVSS score of CVE-2009-3555?

CVE-2009-3555 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Q: What CWE is associated with CVE-2009-3555?

CVE-2009-3555 is classified under CWE-295: Improper Certificate Validation (The product does not validate, or incorrectly validates, a certificate.).

Q: How can I check Maven dependencies for CVE-2009-3555?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.tomcat'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

CRITICAL

Advisory Identifier: GHSA-f7w7-6pjc-wwm6

CVSS 9.8

CWE-295 CWE-300

Published 2022-05-02

Advisory Summary

CVE-2009-3555 is a CRITICAL (CVSS 9.8) apache tomcat affected by vulnerability vulnerability (CWE-295: Improper Certificate Validation) affecting Apache Tomcat libraries in the Maven ecosystem. The issue involves apache tomcat affected by vulnerability in tls and ssl protocol. Remediation is available by upgrading affected packages to version 7.0.10, 6.0.32, 5.5.33.

CVE-2009-3555 at a Glance

CVE Identifier CVE-2009-3555

GHSA Identifier GHSA-f7w7-6pjc-wwm6

Severity CRITICAL

CVSS v3.1 Base Score 9.8

CWE Classification CWE-295: Improper Certificate Validation

Affected Product Apache Tomcat

Package Ecosystem Maven

Published Date 2022-05-02

Last Updated 2026-06-08

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

How to Fix CVE-2009-3555

To remediate this vulnerability, upgrade all affected Apache Tomcat dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.tomcat:tomcat fixed: 7.0.10

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>7.0.10</version>
</dependency>

org.apache.tomcat:tomcat fixed: 6.0.32

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>6.0.32</version>
</dependency>

org.apache.tomcat:tomcat fixed: 5.5.33

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat</artifactId>
    <version>5.5.33</version>
</dependency>

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

mvn dependency:tree -Dincludes=org.apache.tomcat

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2009-3555, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.tomcat

Analyze the terminal output to locate any version of Apache Tomcat in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 7.0.10), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.tomcat command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-295: Improper Certificate Validation, where the product does not validate, or incorrectly validates, a certificate. In Apache Tomcat, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue. Apache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.

CVE-2009-3555 Affected Apache Tomcat Versions

3 component(s)

Fixed Versions:

7.0.106.0.325.5.33

Product / Package	Ecosystem	Affected Versions	Fixed Version
org.apache.tomcat:tomcat maven/org.apache.tomcat/tomcat	Maven	≥ 7.0.0 < 7.0.10	7.0.10
org.apache.tomcat:tomcat maven/org.apache.tomcat/tomcat	Maven	≥ 6.0.0 < 6.0.32	6.0.32
org.apache.tomcat:tomcat maven/org.apache.tomcat/tomcat	Maven	≥ 5.0.0 < 5.5.33	5.5.33

References

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0164

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0163

Apache Tomcat Security Information SECURITY

https://tomcat.apache.org/security-5.html

svn.resiprocate.org/rep/ietf-drafts/ekr... WEB

https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt

support.f5.com/kb/en-us/solutions/... WEB

https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8535

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8366

NVD — CVE-2009-3555 NVD

https://nvd.nist.gov/vuln/detail/CVE-2009-3555

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/df9633116b5fec8f47f1f008fb89a6e9d5895cd0

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/b4e9488629bf03b4b65abf335e536e85386d1366

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/56f67141e82e16f68a860c3af9b7342da35cbe7d

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/3d315ac9dfaa2c03b4df82938d78bf5b755766b3

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/328a523cbb2a2d4cd55283180614d4e03e2f8f02

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/30af3f5630542a2340781f66553e734a6fd69701

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/2d4ca03acc27cc883c404d1745d92f983b6fada3

Security Fix Commit FIX COMMIT

https://github.com/apache/tomcat/commit/14e4efd925da58b9fa63f20969fb7349b8a9c30d

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088

lists.apache.org/thread.html/rf8e8c0... WEB

https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/re3b72c... WEB

https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/f8e0814... WEB

https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E

lists.apache.org/thread.html/ba661b0... WEB

https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E

kb.bluecoat.com/index WEB

https://kb.bluecoat.com/index?page=content&id=SA50

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html

www.redhat.com/archives/fedora-pac... WEB

https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html

www.exploit-db.com/exploits/10579 WEB

https://www.exploit-db.com/exploits/10579

Apache Tomcat Security Information SECURITY

https://tomcat.apache.org/security-7.html

Apache Tomcat Security Information SECURITY

https://tomcat.apache.org/security-6.html

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7973

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7478

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7315

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11617

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11578

Apache Tomcat Security Information SECURITY

https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10088

access.redhat.com/errata/rhsa-2010:04... WEB

https://access.redhat.com/errata/RHSA-2010:0440

access.redhat.com/errata/rhsa-2010:04... WEB

https://access.redhat.com/errata/RHSA-2010:0408

access.redhat.com/errata/rhsa-2010:03... WEB

https://access.redhat.com/errata/RHSA-2010:0339

access.redhat.com/errata/rhsa-2010:03... WEB

https://access.redhat.com/errata/RHSA-2010:0338

access.redhat.com/errata/rhsa-2010:03... WEB

https://access.redhat.com/errata/RHSA-2010:0337

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0167

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0166

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0165

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0162

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0155

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0130

access.redhat.com/errata/rhsa-2010:01... WEB

https://access.redhat.com/errata/RHSA-2010:0119

access.redhat.com/errata/rhsa-2010:00... WEB

https://access.redhat.com/errata/RHSA-2010:0011

access.redhat.com/errata/rhsa-2009:16... WEB

https://access.redhat.com/errata/RHSA-2009:1694

access.redhat.com/errata/rhsa-2009:15... WEB

https://access.redhat.com/errata/RHSA-2009:1580

access.redhat.com/errata/rhsa-2009:15... WEB

https://access.redhat.com/errata/RHSA-2009:1579

h20566.www2.hpe.com/portal/site/hpsc/pu... WEB

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888

Apache Tomcat Source Repository REPOSITORY

https://github.com/apache/tomcat

exchange.xforce.ibmcloud.com/vulnerabilities/541... WEB

https://exchange.xforce.ibmcloud.com/vulnerabilities/54158

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023275

Apache Tomcat Security Information SECURITY

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049

bz.apache.org/bugzilla/show_bug.c... WEB

https://bz.apache.org/bugzilla/show_bug.cgi?id=50325

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=533125

bugzilla.mozilla.org/show_bug.cgi WEB

https://bugzilla.mozilla.org/show_bug.cgi?id=545755

bugzilla.mozilla.org/show_bug.cgi WEB

https://bugzilla.mozilla.org/show_bug.cgi?id=526689

Apache Tomcat Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2009-3555

access.redhat.com/errata/rhsa-2015:15... WEB

https://access.redhat.com/errata/RHSA-2015:1591

access.redhat.com/errata/rhsa-2011:08... WEB

https://access.redhat.com/errata/RHSA-2011:0880

access.redhat.com/errata/rhsa-2010:09... WEB

https://access.redhat.com/errata/RHSA-2010:0987

access.redhat.com/errata/rhsa-2010:09... WEB

https://access.redhat.com/errata/RHSA-2010:0986

access.redhat.com/errata/rhsa-2010:08... WEB

https://access.redhat.com/errata/RHSA-2010:0865

access.redhat.com/errata/rhsa-2010:08... WEB

https://access.redhat.com/errata/RHSA-2010:0807

access.redhat.com/errata/rhsa-2010:07... WEB

https://access.redhat.com/errata/RHSA-2010:0786

access.redhat.com/errata/rhsa-2010:07... WEB

https://access.redhat.com/errata/RHSA-2010:0770

access.redhat.com/errata/rhsa-2010:07... WEB

https://access.redhat.com/errata/RHSA-2010:0768

archives.neohapsis.com/archives/bugtraq/20... WEB

http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html

blog.g-sec.lu/2009/11/tls-sslv3-r... WEB

http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html

blogs.iss.net/archive/sslmitmiscs... WEB

http://blogs.iss.net/archive/sslmitmiscsrf.html

Apache Tomcat Security Information SECURITY

http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during

clicky.me/tlsvuln WEB

http://clicky.me/tlsvuln

extendedsubset.com/ WEB

http://extendedsubset.com/?p=8

extendedsubset.com/renegotiating_tls.p... WEB

http://extendedsubset.com/Renegotiating_TLS.pdf

h20000.www2.hp.com/bizsupport/techsupp... WEB

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686

h20000.www2.hp.com/bizsupport/techsupp... WEB

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041

itrc.hp.com/service/cki/docdisp... WEB

http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751

kbase.redhat.com/faq/docs/doc-20491 WEB

http://kbase.redhat.com/faq/docs/DOC-20491

Apache Tomcat Security Information SECURITY

http://lists.apple.com/archives/security-announce/2010//May/msg00001.html

Apache Tomcat Security Information SECURITY

http://lists.apple.com/archives/security-announce/2010//May/msg00002.html

Apache Tomcat Security Information SECURITY

http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html

lists.gnu.org/archive/html/gnutls... WEB

http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html

Apache Tomcat Security Information SECURITY

http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html

marc.info/ WEB

http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=126150535619567&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=127128920008563&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=127419602507642&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=127557596201693&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=130497311408250&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=132077688910227&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=133469267822771&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=134254866602253&w=2

marc.info/ WEB

http://marc.info/?l=bugtraq&m=142660345230545&w=2

marc.info/ WEB

http://marc.info/?l=cryptography&m=125752275331877&w=2

openbsd.org/errata45.html WEB

http://openbsd.org/errata45.html#010_openssl

openbsd.org/errata46.html WEB

http://openbsd.org/errata46.html#004_openssl

seclists.org/fulldisclosure/2009... WEB

http://seclists.org/fulldisclosure/2009/Nov/139

Apache Tomcat Security Information SECURITY

http://security.gentoo.org/glsa/glsa-200912-01.xml

Apache Tomcat Security Information SECURITY

http://security.gentoo.org/glsa/glsa-201203-22.xml

Apache Tomcat Security Information SECURITY

http://security.gentoo.org/glsa/glsa-201406-32.xml

Apache Tomcat Security Information SECURITY

http://securitytracker.com/id?1023148

Apache Tomcat Security Information SECURITY

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446

sunsolve.sun.com/search/document.do WEB

http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1

sunsolve.sun.com/search/document.do WEB

http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1

sunsolve.sun.com/search/document.do WEB

http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1

sunsolve.sun.com/search/document.do WEB

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1

sunsolve.sun.com/search/document.do WEB

http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1

support.apple.com/kb/ht4004 WEB

http://support.apple.com/kb/HT4004

support.apple.com/kb/ht4170 WEB

http://support.apple.com/kb/HT4170

support.apple.com/kb/ht4171 WEB

http://support.apple.com/kb/HT4171

support.avaya.com/css/p8/documents/10... WEB

http://support.avaya.com/css/P8/documents/100070150

support.avaya.com/css/p8/documents/10... WEB

http://support.avaya.com/css/P8/documents/100081611

support.avaya.com/css/p8/documents/10... WEB

http://support.avaya.com/css/P8/documents/100114315

support.avaya.com/css/p8/documents/10... WEB

http://support.avaya.com/css/P8/documents/100114327

support.citrix.com/article/ctx123359 WEB

http://support.citrix.com/article/CTX123359

support.zeus.com/zws/media/docs/4.3/... WEB

http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES

support.zeus.com/zws/news/2010/01/13... WEB

http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released

sysoev.ru/nginx/patch.cve-200... WEB

http://sysoev.ru/nginx/patch.cve-2009-3555.txt

tomcat.apache.org/native-doc/miscella... WEB

http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html

ubuntu.com/usn/usn-923-1 WEB

http://ubuntu.com/usn/usn-923-1

wiki.rpath.com/advisories:rpsa-200... WEB

http://wiki.rpath.com/Advisories:rPSA-2009-0155

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21426108

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg21432298

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg24006386

www-01.ibm.com/support/docview.wss WEB

http://www-01.ibm.com/support/docview.wss?uid=swg24025312

www-1.ibm.com/support/search.wss WEB

http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only

www.arubanetworks.com/support/alerts/aid-... WEB

http://www.arubanetworks.com/support/alerts/aid-020810.txt

www.betanews.com/article/1257452450 WEB

http://www.betanews.com/article/1257452450

Apache Tomcat Security Information SECURITY

http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml

Apache Tomcat Security Information SECURITY

http://www.debian.org/security/2009/dsa-1934

Apache Tomcat Security Information SECURITY

http://www.debian.org/security/2011/dsa-2141

Apache Tomcat Security Information SECURITY

http://www.debian.org/security/2015/dsa-3253

www.educatedguesswork.org/2009/11/understandi... WEB

http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html

Apache Tomcat Security Information SECURITY

http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html

www.ietf.org/mail-archive/web/tl... WEB

http://www.ietf.org/mail-archive/web/tls/current/msg03928.html

www.ietf.org/mail-archive/web/tl... WEB

http://www.ietf.org/mail-archive/web/tls/current/msg03948.html

www.ingate.com/relnote.php WEB

http://www.ingate.com/Relnote.php?ver=481

www.itrc.hp.com/service/cki/docdisp... WEB

http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995

www.kb.cert.org/vuls/id/120541 WEB

http://www.kb.cert.org/vuls/id/120541

www.links.org/ WEB

http://www.links.org/?p=780

www.links.org/ WEB

http://www.links.org/?p=786

www.links.org/ WEB

http://www.links.org/?p=789

Apache Tomcat Security Information SECURITY

http://www.mandriva.com/security/advisories?name=MDVSA-2010:076

Apache Tomcat Security Information SECURITY

http://www.mandriva.com/security/advisories?name=MDVSA-2010:084

Apache Tomcat Security Information SECURITY

http://www.mandriva.com/security/advisories?name=MDVSA-2010:089

Apache Tomcat Security Information SECURITY

http://www.mozilla.org/security/announce/2010/mfsa2010-22.html

Apache Tomcat Security Information SECURITY

http://www.openoffice.org/security/cves/CVE-2009-3555.html

www.openssl.org/news/secadv_2009111... WEB

http://www.openssl.org/news/secadv_20091111.txt

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2009/11/05/3

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2009/11/05/5

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2009/11/06/3

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2009/11/07/3

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2009/11/20/1

Apache Tomcat Security Information SECURITY

http://www.openwall.com/lists/oss-security/2009/11/23/10

www.opera.com/docs/changelogs/uni... WEB

http://www.opera.com/docs/changelogs/unix/1060

www.opera.com/support/search/view... WEB

http://www.opera.com/support/search/view/944

Apache Tomcat Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html

Apache Tomcat Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html

Apache Tomcat Security Information SECURITY

http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html

www.proftpd.org/docs/release_notes-... WEB

http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0119.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0130.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0155.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0165.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0167.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0337.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0338.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0339.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0768.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0770.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0786.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0807.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0865.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0986.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2010-0987.html

www.redhat.com/support/errata/rhsa... WEB

http://www.redhat.com/support/errata/RHSA-2011-0880.html

www.securegoose.org/2009/11/tls-renegot... WEB

http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/archive/1/507952/100/0/threaded

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/archive/1/508075/100/0/threaded

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/archive/1/508130/100/0/threaded

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/archive/1/515055/100/0/threaded

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/archive/1/516397/100/0/threaded

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/archive/1/522176

Apache Tomcat Security Information SECURITY

http://www.securityfocus.com/bid/36935

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023163

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023204

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023205

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023206

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023207

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023208

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023209

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023210

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023211

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023212

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023213

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023214

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023215

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023216

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023217

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023218

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023219

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023224

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023243

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023270

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023271

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023272

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023273

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023274

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023411

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023426

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023427

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1023428

Apache Tomcat Security Information SECURITY

http://www.securitytracker.com/id?1024789

www.tombom.co.uk/blog/ WEB

http://www.tombom.co.uk/blog/?p=85

www.ubuntu.com/usn/usn-1010-1 WEB

http://www.ubuntu.com/usn/USN-1010-1

www.ubuntu.com/usn/usn-927-1 WEB

http://www.ubuntu.com/usn/USN-927-1

www.ubuntu.com/usn/usn-927-4 WEB

http://www.ubuntu.com/usn/USN-927-4

www.ubuntu.com/usn/usn-927-5 WEB

http://www.ubuntu.com/usn/USN-927-5

www.us-cert.gov/cas/techalerts/ta10... WEB

http://www.us-cert.gov/cas/techalerts/TA10-222A.html

www.us-cert.gov/cas/techalerts/ta10... WEB

http://www.us-cert.gov/cas/techalerts/TA10-287A.html

Apache Tomcat Security Information SECURITY

http://www.vmware.com/security/advisories/VMSA-2010-0019.html

Apache Tomcat Security Information SECURITY

http://www.vmware.com/security/advisories/VMSA-2011-0003.html

www.vmware.com/support/vsphere4/do... WEB

http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html

xss.cx/examples/plesk-repo... WEB

http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html

Frequently Asked Questions

What is CVE-2009-3555?

CVE-2009-3555 is a security vulnerability in Apache Tomcat involving Apache Tomcat affected by vulnerability in TLS and SSL protocol under CWE-295: Improper Certificate Validation.

Which Apache Tomcat versions are affected?

Affected versions include releases prior to 7.0.10, 6.0.32, 5.5.33 across affected packages: org.apache.tomcat:tomcat.

What version fixes CVE-2009-3555?

Upgrading to 7.0.10, 6.0.32, 5.5.33 (or the latest patched release for your respective branch) resolves the vulnerability.

Is tomcat affected?

Yes, org.apache.tomcat:tomcat is affected in releases prior to 7.0.10, 6.0.32, 5.5.33. Upgrade your dependency to 7.0.10, 6.0.32, 5.5.33 or later.

What is the CVSS score of CVE-2009-3555?

CVE-2009-3555 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

What CWE is associated with CVE-2009-3555?

CVE-2009-3555 is classified under CWE-295: Improper Certificate Validation (The product does not validate, or incorrectly validates, a certificate.).

How can I check Maven dependencies for CVE-2009-3555?

Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.tomcat'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-f7w7-6pjc-wwm6",
  "modified" : "2026-06-08T23:46:14Z",
  "published" : "2022-05-02T03:46:22Z",
  "aliases" : [ "CVE-2009-3555" ],
  "summary" : "Apache Tomcat affected by vulnerability in TLS and SSL protocol",
  "details" : "The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a \"plaintext injection\" attack, aka the \"Project Mogul\" issue.\n\nApache Tomcat was affected by this issue and introduced a workaround in versions 7.0.10, 6.0.32, and 5.5.33.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "7.0.0"
      }, {
        "fixed" : "7.0.10"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.0.32"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.tomcat:tomcat"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "5.0.0"
      }, {
        "fixed" : "5.5.33"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2009-3555"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/df9633116b5fec8f47f1f008fb89a6e9d5895cd0"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/b4e9488629bf03b4b65abf335e536e85386d1366"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/56f67141e82e16f68a860c3af9b7342da35cbe7d"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/3d315ac9dfaa2c03b4df82938d78bf5b755766b3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/328a523cbb2a2d4cd55283180614d4e03e2f8f02"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/30af3f5630542a2340781f66553e734a6fd69701"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/2d4ca03acc27cc883c404d1745d92f983b6fada3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/tomcat/commit/14e4efd925da58b9fa63f20969fb7349b8a9c30d"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8535"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8366"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7973"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7478"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7315"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11617"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11578"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10088"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/re3b72cbb13e1dfe85c4a06959a3b6ca6d939b407ecca80db12b54220%40%3Cdev.tomcat.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/f8e0814e11c7f21f42224b6de111cb3f5e5ab5c15b78924c516d4ec2%40%3Cdev.tomcat.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3E"
  }, {
    "type" : "WEB",
    "url" : "https://kb.bluecoat.com/index?page=content&id=SA50"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01029.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01020.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00944.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00645.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00634.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00449.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00442.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00428.html"
  }, {
    "type" : "WEB",
    "url" : "https://www.exploit-db.com/exploits/10579"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-7.html"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-6.html"
  }, {
    "type" : "WEB",
    "url" : "https://tomcat.apache.org/security-5.html"
  }, {
    "type" : "WEB",
    "url" : "https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt"
  }, {
    "type" : "WEB",
    "url" : "https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8535"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8366"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7973"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7478"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7315"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11617"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11578"
  }, {
    "type" : "WEB",
    "url" : "https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10088"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0440"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0408"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0339"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0338"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0337"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0167"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0166"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0165"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0164"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0163"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0162"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0155"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0130"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0119"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0011"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2009:1694"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2009:1580"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2009:1579"
  }, {
    "type" : "WEB",
    "url" : "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/tomcat"
  }, {
    "type" : "WEB",
    "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/54158"
  }, {
    "type" : "WEB",
    "url" : "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-049"
  }, {
    "type" : "WEB",
    "url" : "https://bz.apache.org/bugzilla/show_bug.cgi?id=50325"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=533125"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.mozilla.org/show_bug.cgi?id=545755"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.mozilla.org/show_bug.cgi?id=526689"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2009-3555"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2015:1591"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2011:0880"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0987"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0986"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0865"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0807"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0786"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0770"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/errata/RHSA-2010:0768"
  }, {
    "type" : "WEB",
    "url" : "http://archives.neohapsis.com/archives/bugtraq/2013-11/0120.html"
  }, {
    "type" : "WEB",
    "url" : "http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html"
  }, {
    "type" : "WEB",
    "url" : "http://blogs.iss.net/archive/sslmitmiscsrf.html"
  }, {
    "type" : "WEB",
    "url" : "http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during"
  }, {
    "type" : "WEB",
    "url" : "http://clicky.me/tlsvuln"
  }, {
    "type" : "WEB",
    "url" : "http://extendedsubset.com/?p=8"
  }, {
    "type" : "WEB",
    "url" : "http://extendedsubset.com/Renegotiating_TLS.pdf"
  }, {
    "type" : "WEB",
    "url" : "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01945686"
  }, {
    "type" : "WEB",
    "url" : "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02436041"
  }, {
    "type" : "WEB",
    "url" : "http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02273751"
  }, {
    "type" : "WEB",
    "url" : "http://kbase.redhat.com/faq/docs/DOC-20491"
  }, {
    "type" : "WEB",
    "url" : "http://lists.apple.com/archives/security-announce/2010//May/msg00001.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.apple.com/archives/security-announce/2010//May/msg00002.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039561.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2010-April/039957.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2010-May/040652.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049702.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.gnu.org/archive/html/gnutls-devel/2009-11/msg00029.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00009.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00013.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00014.html"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=apache-httpd-announce&m=125755783724966&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=126150535619567&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=127128920008563&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=127419602507642&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=127557596201693&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=130497311408250&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=132077688910227&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=133469267822771&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=134254866602253&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=bugtraq&m=142660345230545&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://marc.info/?l=cryptography&m=125752275331877&w=2"
  }, {
    "type" : "WEB",
    "url" : "http://openbsd.org/errata45.html#010_openssl"
  }, {
    "type" : "WEB",
    "url" : "http://openbsd.org/errata46.html#004_openssl"
  }, {
    "type" : "WEB",
    "url" : "http://seclists.org/fulldisclosure/2009/Nov/139"
  }, {
    "type" : "WEB",
    "url" : "http://security.gentoo.org/glsa/glsa-200912-01.xml"
  }, {
    "type" : "WEB",
    "url" : "http://security.gentoo.org/glsa/glsa-201203-22.xml"
  }, {
    "type" : "WEB",
    "url" : "http://security.gentoo.org/glsa/glsa-201406-32.xml"
  }, {
    "type" : "WEB",
    "url" : "http://securitytracker.com/id?1023148"
  }, {
    "type" : "WEB",
    "url" : "http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.597446"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-26-273350-1"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-66-273029-1"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-66-274990-1"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021653.1-1"
  }, {
    "type" : "WEB",
    "url" : "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021752.1-1"
  }, {
    "type" : "WEB",
    "url" : "http://support.apple.com/kb/HT4004"
  }, {
    "type" : "WEB",
    "url" : "http://support.apple.com/kb/HT4170"
  }, {
    "type" : "WEB",
    "url" : "http://support.apple.com/kb/HT4171"
  }, {
    "type" : "WEB",
    "url" : "http://support.avaya.com/css/P8/documents/100070150"
  }, {
    "type" : "WEB",
    "url" : "http://support.avaya.com/css/P8/documents/100081611"
  }, {
    "type" : "WEB",
    "url" : "http://support.avaya.com/css/P8/documents/100114315"
  }, {
    "type" : "WEB",
    "url" : "http://support.avaya.com/css/P8/documents/100114327"
  }, {
    "type" : "WEB",
    "url" : "http://support.citrix.com/article/CTX123359"
  }, {
    "type" : "WEB",
    "url" : "http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES"
  }, {
    "type" : "WEB",
    "url" : "http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released"
  }, {
    "type" : "WEB",
    "url" : "http://sysoev.ru/nginx/patch.cve-2009-3555.txt"
  }, {
    "type" : "WEB",
    "url" : "http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html"
  }, {
    "type" : "WEB",
    "url" : "http://ubuntu.com/usn/usn-923-1"
  }, {
    "type" : "WEB",
    "url" : "http://wiki.rpath.com/Advisories:rPSA-2009-0155"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg1IC67848"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68054"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg1IC68055"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg1PM12247"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21426108"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg21432298"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg24006386"
  }, {
    "type" : "WEB",
    "url" : "http://www-01.ibm.com/support/docview.wss?uid=swg24025312"
  }, {
    "type" : "WEB",
    "url" : "http://www-1.ibm.com/support/search.wss?rs=0&q=PM00675&apar=only"
  }, {
    "type" : "WEB",
    "url" : "http://www.arubanetworks.com/support/alerts/aid-020810.txt"
  }, {
    "type" : "WEB",
    "url" : "http://www.betanews.com/article/1257452450"
  }, {
    "type" : "WEB",
    "url" : "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b01d1d.shtml"
  }, {
    "type" : "WEB",
    "url" : "http://www.debian.org/security/2009/dsa-1934"
  }, {
    "type" : "WEB",
    "url" : "http://www.debian.org/security/2011/dsa-2141"
  }, {
    "type" : "WEB",
    "url" : "http://www.debian.org/security/2015/dsa-3253"
  }, {
    "type" : "WEB",
    "url" : "http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.ietf.org/mail-archive/web/tls/current/msg03928.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.ietf.org/mail-archive/web/tls/current/msg03948.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.ingate.com/Relnote.php?ver=481"
  }, {
    "type" : "WEB",
    "url" : "http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02512995"
  }, {
    "type" : "WEB",
    "url" : "http://www.kb.cert.org/vuls/id/120541"
  }, {
    "type" : "WEB",
    "url" : "http://www.links.org/?p=780"
  }, {
    "type" : "WEB",
    "url" : "http://www.links.org/?p=786"
  }, {
    "type" : "WEB",
    "url" : "http://www.links.org/?p=789"
  }, {
    "type" : "WEB",
    "url" : "http://www.mandriva.com/security/advisories?name=MDVSA-2010:076"
  }, {
    "type" : "WEB",
    "url" : "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084"
  }, {
    "type" : "WEB",
    "url" : "http://www.mandriva.com/security/advisories?name=MDVSA-2010:089"
  }, {
    "type" : "WEB",
    "url" : "http://www.mozilla.org/security/announce/2010/mfsa2010-22.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.openoffice.org/security/cves/CVE-2009-3555.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.openssl.org/news/secadv_20091111.txt"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2009/11/05/3"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2009/11/05/5"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2009/11/06/3"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2009/11/07/3"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2009/11/20/1"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2009/11/23/10"
  }, {
    "type" : "WEB",
    "url" : "http://www.opera.com/docs/changelogs/unix/1060"
  }, {
    "type" : "WEB",
    "url" : "http://www.opera.com/support/search/view/944"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0119.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0130.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0155.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0165.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0167.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0337.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0338.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0339.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0768.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0770.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0786.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0807.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0865.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0986.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2010-0987.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.redhat.com/support/errata/RHSA-2011-0880.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/507952/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/508075/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/508130/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/515055/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/516397/100/0/threaded"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/archive/1/522176"
  }, {
    "type" : "WEB",
    "url" : "http://www.securityfocus.com/bid/36935"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023163"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023204"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023205"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023206"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023207"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023208"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023209"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023210"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023211"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023212"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023213"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023214"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023215"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023216"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023217"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023218"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023219"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023224"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023243"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023270"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023271"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023272"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023273"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023274"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023275"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023411"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023426"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023427"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1023428"
  }, {
    "type" : "WEB",
    "url" : "http://www.securitytracker.com/id?1024789"
  }, {
    "type" : "WEB",
    "url" : "http://www.tombom.co.uk/blog/?p=85"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-1010-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-927-1"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-927-4"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-927-5"
  }, {
    "type" : "WEB",
    "url" : "http://www.us-cert.gov/cas/techalerts/TA10-222A.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.us-cert.gov/cas/techalerts/TA10-287A.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.vmware.com/security/advisories/VMSA-2010-0019.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.vmware.com/security/advisories/VMSA-2011-0003.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html"
  }, {
    "type" : "WEB",
    "url" : "http://xss.cx/examples/plesk-reports/plesk-parallels-controlpanel-psa.v.10.3.1_build1013110726.09%20os_redhat.el6-billing-system-plugin-javascript-injection-example-poc-report.html"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-295", "CWE-300" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-02-22T19:39:23Z",
    "nvd_published_at" : "2009-11-09T17:30:00Z"
  }
}

CVSS V3

9.8 CRITICAL

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity High (I:H)

Availability High (A:H)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Advisory Metadata

Source ID: GHSA-f7w7-6pjc-wwm6
Schema Version: 1.4.0
Published: 2022-05-02 03:46
Last Modified: 2026-06-08 23:46
Database Record File: advisories/github-reviewed/2022/05/GHSA-f7w7-6pjc-wwm6/GHSA-f7w7-6pjc-wwm6.json