What is CVE-2009-3766?

CVE-2009-3766 is a vulnerability in Mutt, classified under Cryptographic Issues. Published 2009-10-23.

Is CVE-2009-3766 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Mutt

CVE-2009-3766

mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Vulnerability class: POODLE (CVE-2014-3566)

EPSS: 0.011 (63.3th percentile) — read the EPSS interpretation.

Affected products

Mutt
Openssl
N/a — versions n/a

Weakness classification (CWE)

CWE-310 — Cryptographic Issues

Public proof-of-concept exploits

References

cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2009-3766?: CVE-2009-3766 is a vulnerability in Mutt, classified under Cryptographic Issues. Published 2009-10-23.
Is CVE-2009-3766 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.