DEBIAN-CVE-2009-3555
Record from OSV · Published November 9, 2009
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openssl | Debian:13 | 0.9.8k-6 |
| pound | Debian:14 | 2.6-6.1 |
| tomcat-native | Debian:12 | 1.1.18-1 |
| nginx | Debian:14 | 0.7.64-1 |
| lighttpd | Debian:13 | 1.4.30-1 |
| tomcat-native | Debian:13 | 1.1.18-1 |
| lighttpd | Debian:12 | 1.4.30-1 |
| openssl | Debian:12 | 0.9.8k-6 |
| openssl | Debian:14 | 0.9.8k-6 |
| apache2 | Debian:12 | 2.2.14-2 |
| nss | Debian:12 | 3.12.6-1 |
| lighttpd | Debian:14 | 1.4.30-1 |
8 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | openssl | 0 |
| Debian:14 | pound | 0 |
| Debian:12 | tomcat-native | 0 |
| Debian:14 | nginx | 0 |
| Debian:13 | lighttpd | 0 |
| Debian:13 | tomcat-native | 0 |
| Debian:12 | lighttpd | 0 |
| Debian:12 | openssl | 0 |
| Debian:14 | openssl | 0 |
| Debian:12 | apache2 | 0 |
| Debian:12 | nss | 0 |
| Debian:14 | lighttpd | 0 |
| Debian:13 | nginx | 0 |
| Debian:14 | nss | 0 |
| Debian:14 | apache2 | 0 |
| Debian:13 | nss | 0 |
| Debian:14 | tomcat-native | 0 |
| Debian:12 | nginx | 0 |
| Debian:13 | apache2 | 0 |
| Debian:13 | pound | 0 |
Timeline
- Nov 9, 2009 CVE Published
- Oct 23, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2009-3555
vulnetix vdb fixes DEBIAN-CVE-2009-3555Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2009-3555/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart