CVE-2009-3291

Name	CVE-2009-3291
Description	The php_openssl_apply_verification_policy function in PHP before 5.2.11 does not properly perform certificate validation, which has unknown impact and attack vectors, probably related to an ability to spoof certificates.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
References	DSA-1940-1

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
php5	source	etch	5.2.0+dfsg-8+etch16		DSA-1940-1
php5	source	lenny	5.2.6.dfsg.1-1+lenny4		DSA-1940-1
php5	source	(unstable)	5.2.11.dfsg.1-1	low

Notes

[lenny] - php5 <no-dsa> (rather unimportant)
[etch] - php5 <no-dsa> (rather unimportant)
seems to be related to handling of \0 on CN
not worth a dsa on its own, php doesn't verify certificates by default
experimental is likely to be affected (as of 5.3.0)