CVE-2009-1390

NameCVE-2009-1390
DescriptionMutt 1.5.19, when linked against (1) OpenSSL (mutt_ssl.c) or (2) GnuTLS (mutt_ssl_gnutls.c), allows connections when only one TLS certificate in the chain is accepted instead of verifying the entire chain, which allows remote attackers to spoof trusted servers via a man-in-the-middle attack.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
mutt (PTS)stretch1.7.2-1+deb9u3fixed
stretch (security)1.7.2-1+deb9u5fixed
buster, buster (security)1.10.1-2.1+deb10u5fixed
bookworm, sid, bullseye2.0.5-4.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
muttsourceetch(not affected)
muttsourcelenny(not affected)
muttsourcesqueeze(not affected)
muttsource(unstable)1.5.20-1

Notes

[lenny] - mutt <not-affected> (Affected code was introduced in 1.5.19)
[etch] - mutt <not-affected> (Affected code was introduced in 1.5.19)
[squeeze] - mutt <not-affected> (Affected code was introduced in 1.5.19)

Search for package or bug name: Reporting problems