The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft…
Priority CRITICAL 91CWE-300Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and earlier, multiple Cisco products, and other products, does not properly associate renegotiation handshakes with an existing connection, which allows man-in-the-middle attackers to insert data into HTTPS sessions, and possibly other types of sessions protected by TLS or SSL, by sending an unauthenticated request that is processed retroactively by a server in a post-renegotiation context, related to a "plaintext injection" attack, aka the "Project Mogul" issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.87264 99th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed org.apache.tomcat:tomcat (Maven): 7.0.10, 6.0.32, 5.5.33Red Hat: 27 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | org.apache.tomcat:tomcat (Maven) | 7.0.0 to before 7.0.10 | 7.0.10 | Patch available | GHSA-f7w7-6pjc-wwm6 |
| — | org.apache.tomcat:tomcat (Maven) | 6.0.0 to before 6.0.32 | 6.0.32 | Patch available | GHSA-f7w7-6pjc-wwm6 |
| — | org.apache.tomcat:tomcat (Maven) | 5.0.0 to before 5.5.33 | 5.5.33 | Patch available | GHSA-f7w7-6pjc-wwm6 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.10 Fixed in 7.0.10 Patch available GHSA-f7w7-6pjc-wwm6
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 6.0.0 to before 6.0.32 Fixed in 6.0.32 Patch available GHSA-f7w7-6pjc-wwm6
- org.apache.tomcat:tomcat (Maven) Vendor— Affected 5.0.0 to before 5.5.33 Fixed in 5.5.33 Patch available GHSA-f7w7-6pjc-wwm6
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* | up to 2.2.14 | Vulnerable | Apache |
| cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:* | up to 2.8.5 | Vulnerable | GNU |
| cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:* | up to 3.12.4 | Vulnerable | Mozilla |
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | up to 0.9.8k | Vulnerable | OpenSSL |
| cpe:2.3:a:openssl:openssl:1.0:*:openvms:*:*:*:*:* | 1.0 | Vulnerable | OpenSSL |
| cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:* | 8.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* | 8.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* | 9.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* | 9.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* | 10.04 | Vulnerable | Canonical |
- cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* Versions up to 2.2.14 Vulnerable ·Apache
- cpe:2.3:a:gnu:gnutls:*:*:*:*:*:*:*:* Versions up to 2.8.5 Vulnerable ·GNU
- cpe:2.3:a:mozilla:nss:*:*:*:*:*:*:*:* Versions up to 3.12.4 Vulnerable ·Mozilla
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions up to 0.9.8k Vulnerable ·OpenSSL
- cpe:2.3:a:openssl:openssl:1.0:*:openvms:*:*:*:*:* Versions 1.0 Vulnerable ·OpenSSL
- cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:* Versions 8.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:* Versions 8.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:* Versions 9.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:9.10:*:*:*:*:*:*:* Versions 9.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Versions 10.04 Vulnerable ·Canonical
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* | 10.10 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* | 11 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:* | 12 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:* | 13 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:* | 14 | Vulnerable | Fedoraproject |
| cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* | 0.1.0 – 0.8.22 | Vulnerable | F5 |
- cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:* Versions 10.10 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:* Versions 11 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:12:*:*:*:*:*:*:* Versions 12 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Fedoraproject
- cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:* Versions 0.1.0 – 0.8.22 Vulnerable ·F5
Remediation
- Fix · GHSA-f7w7-6pjc-wwm6 org.apache.tomcat:tomcat (Maven) Fixed in 7.0.10 Advisory →
- Fix · GHSA-f7w7-6pjc-wwm6 org.apache.tomcat:tomcat (Maven) Fixed in 6.0.32 Advisory →
- Fix · GHSA-f7w7-6pjc-wwm6 org.apache.tomcat:tomcat (Maven) Fixed in 5.5.33 Advisory →
Red Hat 27 advisories
- RHSA-2015:1591 Released 2015-08-12 · Red Hat rating ImportantRed Hat Satellite 6.1.1 on RHEL 7
- Red Hat Satellite 6.1 aether-1.13.1-13.el7, aether-api-1.13.1-13.el7, aether-connector-wagon-1.13.1-13.el7 +47
- Red Hat Satellite Capsule 6.1 capsule-installer-2.3.17-1.el7sat, createrepo_c-0.7.4-1.el7sat, createrepo_c-libs-0.7.4-1.el7sat +47
- RHSA-2011:0880 Released 2011-06-16 · Red Hat rating LowRed Hat Network Satellite server IBM Java Runtime security update
- Red Hat Satellite 5.4 (RHEL v.5) java-1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5, java-1.6.0-ibm-1:1.6.0.9.1-1jpp.1.el5.i386, java-1.6.0-ibm-devel-1:1.6.0.9.1-1jpp.1.el5 +1
- RHSA-2010:0987 Released 2010-12-15 · Red Hat rating Criticaljava-1.6.0-ibm security and bug fix update
- Red Hat Desktop version 4 Extras java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.3.el4 +11
- Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4.i386, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4.ppc +18
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.9.0-1jpp.3.el5 +13
- Red Hat Enterprise Linux Desktop Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-devel-1:1.6.0.9.0-1jpp.4.el6 +4
- Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.3.el4 +11
- Red Hat Enterprise Linux HPC Node Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-devel-1:1.6.0.9.0-1jpp.4.el6 +2
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5.i386, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el5.ppc +21
- Red Hat Enterprise Linux Server Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-devel-1:1.6.0.9.0-1jpp.4.el6 +5
- Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.9.0-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.3.el4 +11
- Red Hat Enterprise Linux Workstation Supplementary (v. 6) java-1.6.0-ibm-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-demo-1:1.6.0.9.0-1jpp.4.el6, java-1.6.0-ibm-devel-1:1.6.0.9.0-1jpp.4.el6 +4
Show 24 more Red Hat advisories
- RHSA-2010:0986 Released 2010-12-15 · Red Hat rating Moderatejava-1.4.2-ibm-sap security update
- RHEL 4 AS for SAP java-1.4.2-ibm-sap-1.4.2.13.6.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-demo-1.4.2.13.6.sap-1jpp.1.el4_8, java-1.4.2-ibm-sap-devel-1.4.2.13.6.sap-1jpp.1.el4_8 +2
- RHEL 5 Server for SAP java-1.4.2-ibm-sap-1.4.2.13.6.sap-1jpp.1.el5, java-1.4.2-ibm-sap-demo-1.4.2.13.6.sap-1jpp.1.el5, java-1.4.2-ibm-sap-devel-1.4.2.13.6.sap-1jpp.1.el5 +2
- RHSA-2010:0865 Released 2010-11-10 · Red Hat rating Importantjava-1.6.0-openjdk security and bug fix update
- Red Hat Enterprise Linux Desktop (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0
- Red Hat Enterprise Linux Desktop Optional (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-demo-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-devel-1:1.6.0.0-1.31.b17.el6_0 +2
- Red Hat Enterprise Linux HPC Node (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0
- Red Hat Enterprise Linux HPC Node Optional (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-demo-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-devel-1:1.6.0.0-1.31.b17.el6_0 +2
- Red Hat Enterprise Linux Server (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-devel-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.31.b17.el6_0
- Red Hat Enterprise Linux Server Optional (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-demo-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-src-1:1.6.0.0-1.31.b17.el6_0
- Red Hat Enterprise Linux Workstation (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-devel-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-javadoc-1:1.6.0.0-1.31.b17.el6_0
- Red Hat Enterprise Linux Workstation Optional (v. 6) java-1.6.0-openjdk-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-demo-1:1.6.0.0-1.31.b17.el6_0, java-1.6.0-openjdk-src-1:1.6.0.0-1.31.b17.el6_0
- RHSA-2010:0807 Released 2010-10-27 · Red Hat rating Criticaljava-1.5.0-ibm security update
- Red Hat Desktop version 4 Extras java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.12.2-1jpp.1.el4 +9
- Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4.i386, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4.ppc +17
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5.i386, java-1.5.0-ibm-accessibility-1:1.5.0.12.2-1jpp.1.el5 +11
- Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.12.2-1jpp.1.el4 +9
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5.i386, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el5.ppc +20
- Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4, java-1.5.0-ibm-1:1.5.0.12.2-1jpp.1.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.12.2-1jpp.1.el4 +9
- RHSA-2010:0786 Released 2010-10-20 · Red Hat rating Criticaljava-1.4.2-ibm security update
- Red Hat Desktop version 3 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.i386, java-1.4.2-ibm-demo-1.4.2.13.6-1jpp.3.el3 +7
- Red Hat Desktop version 4 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.i386, java-1.4.2-ibm-demo-1.4.2.13.6-1jpp.2.el4 +9
- Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.ia64 +17
- Red Hat Enterprise Linux AS version 4 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.ia64 +20
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el5, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el5.i386, java-1.4.2-ibm-demo-1.4.2.13.6-1jpp.2.el5 +9
- Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.ia64 +11
- Red Hat Enterprise Linux ES version 4 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.ia64 +13
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el5, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el5.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el5.ia64 +20
- Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.3.el3.ia64 +11
- Red Hat Enterprise Linux WS version 4 Extras java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.i386, java-1.4.2-ibm-1.4.2.13.6-1jpp.2.el4.ia64 +13
- RHSA-2010:0770 Released 2010-10-14 · Red Hat rating Criticaljava-1.6.0-sun security update
- Red Hat Desktop version 4 Extras java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el4 +9
- Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el4 +9
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.22-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.22-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el5 +9
- Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el4 +9
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.22-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.22-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el5 +9
- Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.22-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.22-1jpp.1.el4 +9
- RHSA-2010:0768 Released 2010-10-13 · Red Hat rating Importantjava-1.6.0-openjdk security and bug fix update
- Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5, java-1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.16.b17.el5 +7
- Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5, java-1.6.0-openjdk-1:1.6.0.0-1.16.b17.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.16.b17.el5 +7
- RHSA-2010:0440 Released 2010-05-25 · Red Hat rating Importantrhev-hypervisor security and bug fix update
- Red Hat Enterprise Virtualization Hypervisor 5 rhev-hypervisor-5.4-2.1.12.1.el5_4rhev2_1, rhev-hypervisor-pxe-5.4-2.1.12.1.el5_4rhev2_1
- RHSA-2010:0408 Released 2010-05-12 · Red Hat rating Moderatejava-1.4.2-ibm security update
- RHEL 4 AS for SAP java-1.4.2-ibm-1.4.2.13.4.sap-1jpp.1.el4_8, java-1.4.2-ibm-demo-1.4.2.13.4.sap-1jpp.1.el4_8, java-1.4.2-ibm-devel-1.4.2.13.4.sap-1jpp.1.el4_8 +2
- RHEL 5 Server for SAP java-1.4.2-ibm-1.4.2.13.4.sap-1jpp.1.el5, java-1.4.2-ibm-demo-1.4.2.13.4.sap-1jpp.1.el5, java-1.4.2-ibm-devel-1.4.2.13.4.sap-1jpp.1.el5 +2
- RHSA-2010:0338 Released 2010-04-01 · Red Hat rating Criticaljava-1.5.0-sun security update
- RHEL Supplementary (v. 5.2.Z server) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
- RHEL Supplementary (v. 5.3.Z server) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
- Red Hat Desktop version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
- Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
- Red Hat Enterprise Linux AS version 4.7.z Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
- Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
- Red Hat Enterprise Linux ES version 4.7.z Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el5.i586
- Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4, java-1.5.0-sun-uninstall-1.5.0.22-1jpp.3.el4.i586
- RHSA-2010:0337 Released 2010-04-01 · Red Hat rating Criticaljava-1.6.0-sun security update
- Red Hat Desktop version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
- Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el5 +9
- Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el5.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el5 +9
- Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4, java-1.6.0-sun-1:1.6.0.19-1jpp.1.el4.i586, java-1.6.0-sun-demo-1:1.6.0.19-1jpp.1.el4 +9
- RHSA-2010:0339 Released 2010-04-01 · Red Hat rating Importantjava-1.6.0-openjdk security update
- Red Hat Enterprise Linux (v. 5 server) java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5, java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.11.b16.el5 +7
- Red Hat Enterprise Linux Desktop (v. 5 client) java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5, java-1.6.0-openjdk-1:1.6.0.0-1.11.b16.el5.i386, java-1.6.0-openjdk-demo-1:1.6.0.0-1.11.b16.el5 +7
- RHSA-2010:0167 Released 2010-03-25 · Red Hat rating Moderategnutls security update
- Red Hat Enterprise Linux AS version 4 gnutls-1.0.20-4.el4_8.7, gnutls-1.0.20-4.el4_8.7.i386, gnutls-1.0.20-4.el4_8.7.ia64 +5
- Red Hat Enterprise Linux Desktop version 4 gnutls-1.0.20-4.el4_8.7, gnutls-1.0.20-4.el4_8.7.i386, gnutls-devel-1.0.20-4.el4_8.7 +1
- Red Hat Enterprise Linux ES version 4 gnutls-1.0.20-4.el4_8.7, gnutls-1.0.20-4.el4_8.7.i386, gnutls-1.0.20-4.el4_8.7.ia64 +3
- Red Hat Enterprise Linux WS version 4 gnutls-1.0.20-4.el4_8.7, gnutls-1.0.20-4.el4_8.7.i386, gnutls-1.0.20-4.el4_8.7.ia64 +3
- RHSA-2010:0166 Released 2010-03-25 · Red Hat rating Moderategnutls security update
- Red Hat Enterprise Linux (v. 5 server) gnutls-1.4.1-3.el5_4.8, gnutls-1.4.1-3.el5_4.8.i386, gnutls-1.4.1-3.el5_4.8.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) gnutls-1.4.1-3.el5_4.8, gnutls-1.4.1-3.el5_4.8.i386, gnutls-utils-1.4.1-3.el5_4.8 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) gnutls-1.4.1-3.el5_4.8, gnutls-devel-1.4.1-3.el5_4.8, gnutls-devel-1.4.1-3.el5_4.8.i386
- RHSA-2010:0165 Released 2010-03-25 · Red Hat rating Moderatenss security update
- Red Hat Enterprise Linux (v. 5 server) nspr-4.8.4-1.el5_4, nspr-4.8.4-1.el5_4.i386, nspr-4.8.4-1.el5_4.ia64 +21
- Red Hat Enterprise Linux AS version 4 nspr-4.8.4-1.1.el4_8, nspr-4.8.4-1.1.el4_8.i386, nspr-4.8.4-1.1.el4_8.ia64 +17
- Red Hat Enterprise Linux Desktop (v. 5 client) nspr-4.8.4-1.el5_4, nspr-4.8.4-1.el5_4.i386, nss-3.12.6-1.el5_4 +3
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) nspr-4.8.4-1.el5_4, nspr-devel-4.8.4-1.el5_4, nspr-devel-4.8.4-1.el5_4.i386 +5
- Red Hat Enterprise Linux Desktop version 4 nspr-4.8.4-1.1.el4_8, nspr-4.8.4-1.1.el4_8.i386, nspr-devel-4.8.4-1.1.el4_8 +7
- Red Hat Enterprise Linux ES version 4 nspr-4.8.4-1.1.el4_8, nspr-4.8.4-1.1.el4_8.i386, nspr-4.8.4-1.1.el4_8.ia64 +12
- Red Hat Enterprise Linux WS version 4 nspr-4.8.4-1.1.el4_8, nspr-4.8.4-1.1.el4_8.i386, nspr-4.8.4-1.1.el4_8.ia64 +12
- RHSA-2010:0164 Released 2010-03-25 · Red Hat rating Moderateopenssl097a security update
- Red Hat Enterprise Linux (v. 5 server) openssl097a-0.9.7a-9.el5_4.2, openssl097a-0.9.7a-9.el5_4.2.i386, openssl097a-0.9.7a-9.el5_4.2.ia64 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl097a-0.9.7a-9.el5_4.2, openssl097a-0.9.7a-9.el5_4.2.i386
- RHSA-2010:0163 Released 2010-03-25 · Red Hat rating Moderateopenssl security update
- Red Hat Desktop version 3 openssl-0.9.7a-33.26, openssl-0.9.7a-33.26.i386, openssl-devel-0.9.7a-33.26 +3
- Red Hat Enterprise Linux AS version 3 openssl-0.9.7a-33.26, openssl-0.9.7a-33.26.i386, openssl-0.9.7a-33.26.ia64 +9
- Red Hat Enterprise Linux AS version 4 openssl-0.9.7a-43.17.el4_8.5, openssl-0.9.7a-43.17.el4_8.5.i386, openssl-0.9.7a-43.17.el4_8.5.ia64 +9
- Red Hat Enterprise Linux Desktop version 4 openssl-0.9.7a-43.17.el4_8.5, openssl-0.9.7a-43.17.el4_8.5.i386, openssl-devel-0.9.7a-43.17.el4_8.5 +3
- Red Hat Enterprise Linux ES version 3 openssl-0.9.7a-33.26, openssl-0.9.7a-33.26.i386, openssl-0.9.7a-33.26.ia64 +6
- Red Hat Enterprise Linux ES version 4 openssl-0.9.7a-43.17.el4_8.5, openssl-0.9.7a-43.17.el4_8.5.i386, openssl-0.9.7a-43.17.el4_8.5.ia64 +6
- Red Hat Enterprise Linux WS version 3 openssl-0.9.7a-33.26, openssl-0.9.7a-33.26.i386, openssl-0.9.7a-33.26.ia64 +6
- Red Hat Enterprise Linux WS version 4 openssl-0.9.7a-43.17.el4_8.5, openssl-0.9.7a-43.17.el4_8.5.i386, openssl-0.9.7a-43.17.el4_8.5.ia64 +6
- RHSA-2010:0162 Released 2010-03-25 · Red Hat rating Importantopenssl security update
- Red Hat Enterprise Linux (v. 5 server) openssl-0.9.8e-12.el5_4.6, openssl-0.9.8e-12.el5_4.6.i386, openssl-0.9.8e-12.el5_4.6.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) openssl-0.9.8e-12.el5_4.6, openssl-0.9.8e-12.el5_4.6.i386, openssl-perl-0.9.8e-12.el5_4.6 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openssl-0.9.8e-12.el5_4.6, openssl-devel-0.9.8e-12.el5_4.6, openssl-devel-0.9.8e-12.el5_4.6.i386
- RHSA-2010:0155 Released 2010-03-17 · Red Hat rating Moderatejava-1.4.2-ibm security and bug fix update
- Red Hat Desktop version 3 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.i386, java-1.4.2-ibm-demo-1.4.2.13.4-1jpp.1.el3 +7
- Red Hat Desktop version 4 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.i386, java-1.4.2-ibm-demo-1.4.2.13.4-1jpp.1.el4 +9
- Red Hat Enterprise Linux AS version 3 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.ia64 +17
- Red Hat Enterprise Linux AS version 4 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.ia64 +20
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el5.i386, java-1.4.2-ibm-demo-1.4.2.13.4-1jpp.1.el5 +9
- Red Hat Enterprise Linux ES version 3 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.ia64 +11
- Red Hat Enterprise Linux ES version 4 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.ia64 +13
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el5, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el5.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el5.ia64 +20
- Red Hat Enterprise Linux WS version 3 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el3.ia64 +11
- Red Hat Enterprise Linux WS version 4 Extras java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.i386, java-1.4.2-ibm-1.4.2.13.4-1jpp.1.el4.ia64 +13
- RHSA-2010:0130 Released 2010-03-03 · Red Hat rating Moderatejava-1.5.0-ibm security update
- Red Hat Desktop version 4 Extras java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.11.1-1jpp.3.el4 +9
- Red Hat Enterprise Linux AS version 4 Extras java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4.i386, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4.ppc +17
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5.i386, java-1.5.0-ibm-accessibility-1:1.5.0.11.1-1jpp.3.el5 +11
- Red Hat Enterprise Linux ES version 4 Extras java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.11.1-1jpp.3.el4 +9
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5.i386, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el5.ppc +20
- Red Hat Enterprise Linux WS version 4 Extras java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4, java-1.5.0-ibm-1:1.5.0.11.1-1jpp.3.el4.i386, java-1.5.0-ibm-demo-1:1.5.0.11.1-1jpp.3.el4 +9
- RHSA-2010:0119 Released 2010-02-23 · Red Hat rating LowJBoss Enterprise Web Server 1.0.1 update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server glassfish-jsf-1.2_13-3.ep5.el5, httpd-2.2.14-1.2.1.ep5.el5, httpd-2.2.14-1.2.1.ep5.el5.i386 +40
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS glassfish-jsf-1.2_13-2.ep5.el4, httpd22-2.2.14-4.ep5.el4, httpd22-2.2.14-4.ep5.el4.i386 +47
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES glassfish-jsf-1.2_13-2.ep5.el4, httpd22-2.2.14-4.ep5.el4, httpd22-2.2.14-4.ep5.el4.i386 +47
- RHSA-2010:0011 Released 2010-01-06 · Red Hat rating Moderatehttpd and httpd22 security update
- Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server httpd-2.2.10-11.ep5.el5, httpd-2.2.10-11.ep5.el5.i386, httpd-devel-2.2.10-11.ep5.el5 +5
- Red Hat JBoss Web Server 1.0 for RHEL 4 AS httpd22-2.2.10-25.1.ep5.el4, httpd22-2.2.10-25.1.ep5.el4.i386, httpd22-apr-2.2.10-25.1.ep5.el4 +11
- Red Hat JBoss Web Server 1.0 for RHEL 4 ES httpd22-2.2.10-25.1.ep5.el4, httpd22-2.2.10-25.1.ep5.el4.i386, httpd22-apr-2.2.10-25.1.ep5.el4 +11
- RHSA-2009:1694 Released 2009-12-23 · Red Hat rating Criticaljava-1.6.0-ibm security update
- Red Hat Desktop version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
- Red Hat Enterprise Linux AS version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.ppc +18
- Red Hat Enterprise Linux Desktop Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-accessibility-1:1.6.0.7-1jpp.2.el5 +13
- Red Hat Enterprise Linux ES version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
- Red Hat Enterprise Linux Server Supplementary (v. 5) java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.i386, java-1.6.0-ibm-1:1.6.0.7-1jpp.2.el5.ppc +21
- Red Hat Enterprise Linux WS version 4 Extras java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4, java-1.6.0-ibm-1:1.6.0.7-1jpp.3.el4.i386, java-1.6.0-ibm-demo-1:1.6.0.7-1jpp.3.el4 +11
- RHSA-2009:1580 Released 2009-11-11 · Red Hat rating Moderatehttpd security update
- Red Hat Enterprise Linux AS version 4 httpd-2.0.52-41.ent.6, httpd-2.0.52-41.ent.6.i386, httpd-2.0.52-41.ent.6.ia64 +17
- Red Hat Enterprise Linux Desktop version 4 httpd-2.0.52-41.ent.6, httpd-2.0.52-41.ent.6.i386, httpd-devel-2.0.52-41.ent.6 +7
- Red Hat Enterprise Linux ES version 4 httpd-2.0.52-41.ent.6, httpd-2.0.52-41.ent.6.i386, httpd-2.0.52-41.ent.6.ia64 +12
- Red Hat Enterprise Linux WS version 4 httpd-2.0.52-41.ent.6, httpd-2.0.52-41.ent.6.i386, httpd-2.0.52-41.ent.6.ia64 +12
- RHSA-2009:1579 Released 2009-11-11 · Red Hat rating Moderatehttpd security update
- Red Hat Desktop version 3 httpd-2.0.46-77.ent, httpd-2.0.46-77.ent.i386, httpd-devel-2.0.46-77.ent +3
- Red Hat Enterprise Linux (v. 5 server) httpd-2.2.3-31.el5_4.2, httpd-2.2.3-31.el5_4.2.i386, httpd-2.2.3-31.el5_4.2.ia64 +13
- Red Hat Enterprise Linux AS version 3 httpd-2.0.46-77.ent, httpd-2.0.46-77.ent.i386, httpd-2.0.46-77.ent.ia64 +9
- Red Hat Enterprise Linux Desktop (v. 5 client) httpd-2.2.3-31.el5_4.2, httpd-2.2.3-31.el5_4.2.i386, mod_ssl-1:2.2.3-31.el5_4.2 +1
- Red Hat Enterprise Linux Desktop Workstation (v. 5 client) httpd-2.2.3-31.el5_4.2, httpd-devel-2.2.3-31.el5_4.2, httpd-devel-2.2.3-31.el5_4.2.i386 +2
- Red Hat Enterprise Linux ES version 3 httpd-2.0.46-77.ent, httpd-2.0.46-77.ent.i386, httpd-2.0.46-77.ent.ia64 +6
- Red Hat Enterprise Linux WS version 3 httpd-2.0.46-77.ent, httpd-2.0.46-77.ent.i386, httpd-2.0.46-77.ent.ia64 +6
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHEL 4 AS for SAP | Fixed | RHSA-2010:0408, RHSA-2010:0986 |
| RHEL 5 Server for SAP | Fixed | RHSA-2010:0408, RHSA-2010:0986 |
| RHEL Supplementary (v. 5.2.Z server) | Fixed | RHSA-2010:0338 |
| RHEL Supplementary (v. 5.3.Z server) | Fixed | RHSA-2010:0338 |
| Red Hat Desktop version 3 | Fixed | RHSA-2009:1579, RHSA-2010:0163 |
| Red Hat Desktop version 3 Extras | Fixed | RHSA-2010:0155, RHSA-2010:0786 |
| Red Hat Desktop version 4 Extras | Fixed | RHSA-2009:1694, RHSA-2010:0130, RHSA-2010:0155, RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0770, RHSA-2010:0786, RHSA-2010:0807, RHSA-2010:0987 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2009:1579, RHSA-2010:0162, RHSA-2010:0164, RHSA-2010:0165, RHSA-2010:0166, RHSA-2010:0339, RHSA-2010:0768 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2009:1579, RHSA-2010:0163 |
| Red Hat Enterprise Linux AS version 3 Extras | Fixed | RHSA-2010:0155, RHSA-2010:0786 |
| Red Hat Enterprise Linux AS version 4 | Fixed | RHSA-2009:1580, RHSA-2010:0163, RHSA-2010:0165, RHSA-2010:0167 |
| Red Hat Enterprise Linux AS version 4 Extras | Fixed | RHSA-2009:1694, RHSA-2010:0130, RHSA-2010:0155, RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0770, RHSA-2010:0786, RHSA-2010:0807, RHSA-2010:0987 |
| Red Hat Enterprise Linux AS version 4.7.z Extras | Fixed | RHSA-2010:0338 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2009:1579, RHSA-2010:0162, RHSA-2010:0164, RHSA-2010:0165, RHSA-2010:0166, RHSA-2010:0339, RHSA-2010:0768 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux Desktop Optional (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux Desktop Supplementary (v. 5) | Fixed | RHSA-2009:1694, RHSA-2010:0130, RHSA-2010:0155, RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0770, RHSA-2010:0786, RHSA-2010:0807, RHSA-2010:0987 |
| Red Hat Enterprise Linux Desktop Supplementary (v. 6) | Fixed | RHSA-2010:0987 |
| Red Hat Enterprise Linux Desktop Workstation (v. 5 client) | Fixed | RHSA-2009:1579, RHSA-2010:0162, RHSA-2010:0165, RHSA-2010:0166 |
| Red Hat Enterprise Linux Desktop version 4 | Fixed | RHSA-2009:1580, RHSA-2010:0163, RHSA-2010:0165, RHSA-2010:0167 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2009:1579, RHSA-2010:0163 |
| Red Hat Enterprise Linux ES version 3 Extras | Fixed | RHSA-2010:0155, RHSA-2010:0786 |
| Red Hat Enterprise Linux ES version 4 | Fixed | RHSA-2009:1580, RHSA-2010:0163, RHSA-2010:0165, RHSA-2010:0167 |
| Red Hat Enterprise Linux ES version 4 Extras | Fixed | RHSA-2009:1694, RHSA-2010:0130, RHSA-2010:0155, RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0770, RHSA-2010:0786, RHSA-2010:0807, RHSA-2010:0987 |
| Red Hat Enterprise Linux ES version 4.7.z Extras | Fixed | RHSA-2010:0338 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux HPC Node Optional (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux HPC Node Supplementary (v. 6) | Fixed | RHSA-2010:0987 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux Server Optional (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux Server Supplementary (v. 5) | Fixed | RHSA-2009:1694, RHSA-2010:0130, RHSA-2010:0155, RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0770, RHSA-2010:0786, RHSA-2010:0807, RHSA-2010:0987 |
| Red Hat Enterprise Linux Server Supplementary (v. 6) | Fixed | RHSA-2010:0987 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2009:1579, RHSA-2010:0163 |
| Red Hat Enterprise Linux WS version 3 Extras | Fixed | RHSA-2010:0155, RHSA-2010:0786 |
| Red Hat Enterprise Linux WS version 4 | Fixed | RHSA-2009:1580, RHSA-2010:0163, RHSA-2010:0165, RHSA-2010:0167 |
| Red Hat Enterprise Linux WS version 4 Extras | Fixed | RHSA-2009:1694, RHSA-2010:0130, RHSA-2010:0155, RHSA-2010:0337, RHSA-2010:0338, RHSA-2010:0770, RHSA-2010:0786, RHSA-2010:0807, RHSA-2010:0987 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux Workstation Optional (v. 6) | Fixed | RHSA-2010:0865 |
| Red Hat Enterprise Linux Workstation Supplementary (v. 6) | Fixed | RHSA-2010:0987 |
| Red Hat Enterprise Virtualization Hypervisor 5 | Fixed | RHSA-2010:0440 |
| Red Hat JBoss Enterprise Web Server 1 for RHEL 5 Server | Fixed | RHSA-2010:0011, RHSA-2010:0119 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 AS | Fixed | RHSA-2010:0011, RHSA-2010:0119 |
| Red Hat JBoss Web Server 1.0 for RHEL 4 ES | Fixed | RHSA-2010:0011, RHSA-2010:0119 |
| Red Hat Satellite 5.4 (RHEL v.5) | Fixed | RHSA-2011:0880 |
| Red Hat Satellite 6.1 | Fixed | RHSA-2015:1591 |
| Red Hat Satellite Capsule 6.1 | Fixed | RHSA-2015:1591 |
Timeline
- 2026-10-02 Threatist record created from CVE-2009-3555
- 2026-10-03 Alias added: GHSA-f7w7-6pjc-wwm6
References
Exploit 2
Patch 1
Advisory 184
- APPLE-SA-2010-05-18-1
- http://support.avaya.com/css/P8/documents/100081611
- ADV-2010-0916
- http://support.avaya.com/css/P8/documents/100114327
- RHSA-2010:0167
- ADV-2010-2010
- FEDORA-2009-12750
- ADV-2010-0086
- ADV-2010-1673
- [tls] 20091104 TLS renegotiation issue
- RHSA-2010:0865
- http://www.oracle.com/technetwork/topics/security/cpuapr2011-301950.html
- ADV-2009-3310
- ADV-2009-3205
- http://blogs.sun.com/security/entry/vulnerability_in_tls_protocol_during
- http://support.avaya.com/css/P8/documents/100114315
- GLSA-201406-32
- http://www.ingate.com/Relnote.php?ver=481
- HPSBMU02799
- TA10-222A
- SSRT090249
- SUSE-SA:2010:061
- ADV-2010-3069
- [4.5] 010: SECURITY FIX: November 26, 2009
- http://kbase.redhat.com/faq/docs/DOC-20491
- USN-927-5
- PM12247
- SUSE-SU-2011:0847
- MDVSA-2010:089
- RHSA-2010:0770
- http://www.openssl.org/news/secadv_20091111.txt
- DSA-3253
- ADV-2009-3484
- SSRT101846
- 1021752
- FEDORA-2010-6131
- ADV-2010-0848
- [oss-security] 20091107 Re: [TLS] CVE-2009-3555 for TLS renegotiation MITM attacks
- IC68055
- http://www.links.org/?p=786
- [oss-security] 20091123 Re: CVEs for nginx
- VU#120541
- RHSA-2010:0768
- ADV-2009-3353
- FEDORA-2010-5357
- http://www.openoffice.org/security/cves/CVE-2009-3555.html
- ADV-2011-0032
- openSUSE-SU-2011:0845
- SSRT090208
- ADV-2010-1107
- ADV-2010-1350
- RHSA-2010:0338
- FEDORA-2009-12775
- 20091109 Transport Layer Security Renegotiation Vulnerability
- IC67848
- FEDORA-2010-16240
- ADV-2010-1793
- oval:org.mitre.oval:def:11617
- APPLE-SA-2010-05-18-2
- RHSA-2010:0130
- http://support.apple.com/kb/HT4004
- USN-1010-1
- SUSE-SR:2010:011
- https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05150888
- GLSA-200912-01
- SSRT090180
- ADV-2009-3313
- 274990
- SUSE-SA:2009:057
- HPSBOV02762
- DSA-1934
- FEDORA-2009-12782
- oval:org.mitre.oval:def:7478
- APPLE-SA-2010-01-19-1
- [cryptography] 20091105 OpenSSL 0.9.8l released
- oval:org.mitre.oval:def:7315
- SUSE-SR:2010:013
- USN-927-4
- http://blog.g-sec.lu/2009/11/tls-sslv3-renegotiation-vulnerability.html
- HPSBHF02706
- ADV-2009-3521
- oval:org.mitre.oval:def:7973
- HPSBMA02568
- https://bugzilla.redhat.com/show_bug.cgi?id=533125
- oval:org.mitre.oval:def:10088
- oval:org.mitre.oval:def:11578
- http://www.oracle.com/technetwork/topics/security/cpuoct2010-175626.html
- ADV-2009-3220
- SSRT100179
- SSRT100089
- RHSA-2010:0165
- RHSA-2010:0987
- https://bugzilla.mozilla.org/show_bug.cgi?id=545755
- http://www-01.ibm.com/support/docview.wss?uid=swg21426108
- RHSA-2010:0339
- RHSA-2010:0986
- ADV-2009-3164
- FEDORA-2009-12229
- [tls] 20091104 MITM attack on delayed TLS-client auth through renegotiation
- http://support.avaya.com/css/P8/documents/100070150
- HPSBUX02498
- IC68054
- 273029
- FEDORA-2009-12604
- http://www-01.ibm.com/support/docview.wss?uid=swg21432298
- http://www-01.ibm.com/support/docview.wss?uid=swg24025312
- http://www-01.ibm.com/support/docview.wss?uid=swg24006386
- http://support.apple.com/kb/HT4170
- PM00675
- http://www.vmware.com/support/vsphere4/doc/vsp_vc41_u1_rel_notes.html
- SSA:2009-320-01
- http://www.links.org/?p=789
- http://www.opera.com/docs/changelogs/unix/1060/
- http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
- RHSA-2011:0880
- SUSE-SR:2010:008
- http://www.oracle.com/technetwork/topics/security/javacpuoct2010-176258.html
- [oss-security] 20091107 Re: CVE-2009-3555 for TLS renegotiation MITM attacks
- FEDORA-2009-12305
- http://wiki.rpath.com/Advisories:rPSA-2009-0155
- SUSE-SR:2010:012
- http://support.citrix.com/article/CTX123359
- MDVSA-2010:076
- HPSBUX02517
- ADV-2009-3587
- https://bugzilla.mozilla.org/show_bug.cgi?id=526689
- ADV-2010-0982
- USN-927-1
- FEDORA-2009-12606
- ADV-2010-3126
- ADV-2009-3165
- ADV-2010-1639
- USN-923-1
- oval:org.mitre.oval:def:8366
- http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-030/index.html
- ADV-2010-0933
- http://www.vmware.com/security/advisories/VMSA-2011-0003.html
- ADV-2010-3086
- DSA-2141
- RHSA-2010:0155
- http://www.educatedguesswork.org/2009/11/understanding_the_tls_renegoti.html
- ADV-2011-0033
- RHSA-2010:0337
- ADV-2011-0086
- http://www.opera.com/support/search/view/944/
- [announce] 20091107 CVE-2009-3555 - apache/mod_ssl vulnerability and mitigation
- SUSE-SR:2010:024
- TA10-287A
- http://www.links.org/?p=780
- RHSA-2010:0119
- ADV-2010-0748
- oval:org.mitre.oval:def:8535
- http://www.vmware.com/security/advisories/VMSA-2010-0019.html
- RHSA-2010:0786
- https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
- http://support.apple.com/kb/HT4171
- [oss-security] 20091120 CVEs for nginx
- ADV-2009-3354
- FEDORA-2009-12968
- https://kb.bluecoat.com/index?page=content&id=SA50
- GLSA-201203-22
- [oss-security] 20091105 CVE-2009-3555 for TLS renegotiation MITM attacks
- SUSE-SR:2010:019
- MDVSA-2010:084
- http://www.betanews.com/article/1257452450
- 1021653
- http://www.mozilla.org/security/announce/2010/mfsa2010-22.html
- [4.6] 004: SECURITY FIX: November 26, 2009
- RHSA-2010:0807
- ADV-2010-1191
- 20091111 Re: SSL/TLS MiTM PoC
- https://support.f5.com/kb/en-us/solutions/public/10000/700/sol10737.html
- [oss-security] 20091105 Re: CVE-2009-3555 for TLS renegotiation MITM attacks
- FEDORA-2010-16312
- FEDORA-2010-5942
- ADV-2010-2745
- 273350
- ADV-2010-0994
- ADV-2010-0173
- ADV-2010-1054
- HPSBGN02562
- FEDORA-2010-16294
- [gnutls-devel] 20091105 Re: TLS renegotiation MITM
- https://nvd.nist.gov/vuln/detail/CVE-2009-3555
Other 71
- 62210
- http://www.arubanetworks.com/support/alerts/aid-020810.txt
- http://www.proftpd.org/docs/RELEASE_NOTES-1.3.2c
- 60521
- http://www.tombom.co.uk/blog/?p=85
- http://extendedsubset.com/?p=8
- http://tomcat.apache.org/native-doc/miscellaneous/changelog-1.1.x.html
- http://sysoev.ru/nginx/patch.cve-2009-3555.txt
- http://support.zeus.com/zws/news/2010/01/13/zws_4_3r5_released
- http://support.zeus.com/zws/media/docs/4.3/RELEASE_NOTES
- http://blogs.iss.net/archive/sslmitmiscsrf.html
- http://extendedsubset.com/Renegotiating_TLS.pdf
- 60972
- 65202
- 20131121 ESA-2013-077: RSA Data Protection Manager Appliance Multiple Vulnerabilities
- [tomcat-dev] 20190319 svn commit: r1855831 [26/30] - in /tomcat/site/trunk: ./ docs/ xdocs/
- [tomcat-dev] 20190325 svn commit: r1856174 [26/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/
- [tomcat-dev] 20200203 svn commit: r1873527 [26/30] - /tomcat/site/trunk/docs/
- [tomcat-dev] 20200213 svn commit: r1873980 [31/34] - /tomcat/site/trunk/docs/
- https://github.com/apache/tomcat/commit/df9633116b5fec8f47f1f008fb89a6e9d5895cd0
- https://github.com/apache/tomcat/commit/b4e9488629bf03b4b65abf335e536e85386d1366
- https://github.com/apache/tomcat/commit/56f67141e82e16f68a860c3af9b7342da35cbe7d
- https://github.com/apache/tomcat/commit/3d315ac9dfaa2c03b4df82938d78bf5b755766b3
- https://github.com/apache/tomcat/commit/328a523cbb2a2d4cd55283180614d4e03e2f8f02
- https://github.com/apache/tomcat/commit/30af3f5630542a2340781f66553e734a6fd69701
- https://github.com/apache/tomcat/commit/2d4ca03acc27cc883c404d1745d92f983b6fada3
- https://github.com/apache/tomcat/commit/14e4efd925da58b9fa63f20969fb7349b8a9c30d
- https://www.exploit-db.com/exploits/10579
- https://tomcat.apache.org/security-7.html
- https://tomcat.apache.org/security-6.html
- https://tomcat.apache.org/security-5.html
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8535
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:8366
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7973
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7478
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:7315
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11617
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:11578
- https://oval.cisecurity.org/repository/search/definition/oval:org.mitre.oval:def:10088
- https://access.redhat.com/errata/RHSA-2010:0440
- https://access.redhat.com/errata/RHSA-2010:0408
- https://access.redhat.com/errata/RHSA-2010:0339
- https://access.redhat.com/errata/RHSA-2010:0338
- https://access.redhat.com/errata/RHSA-2010:0337
- https://access.redhat.com/errata/RHSA-2010:0167
- https://access.redhat.com/errata/RHSA-2010:0166
- https://access.redhat.com/errata/RHSA-2010:0165
- https://access.redhat.com/errata/RHSA-2010:0164
- https://access.redhat.com/errata/RHSA-2010:0163
- https://access.redhat.com/errata/RHSA-2010:0162
- https://access.redhat.com/errata/RHSA-2010:0155
- https://access.redhat.com/errata/RHSA-2010:0130
- https://access.redhat.com/errata/RHSA-2010:0119
- https://access.redhat.com/errata/RHSA-2010:0011
- https://access.redhat.com/errata/RHSA-2009:1694
- https://access.redhat.com/errata/RHSA-2009:1580
- https://access.redhat.com/errata/RHSA-2009:1579
- https://github.com/apache/tomcat
- https://bz.apache.org/bugzilla/show_bug.cgi?id=50325
- https://access.redhat.com/security/cve/CVE-2009-3555
- https://access.redhat.com/errata/RHSA-2015:1591
- https://access.redhat.com/errata/RHSA-2011:0880
- https://access.redhat.com/errata/RHSA-2010:0987
- https://access.redhat.com/errata/RHSA-2010:0986
- https://access.redhat.com/errata/RHSA-2010:0865
- https://access.redhat.com/errata/RHSA-2010:0807
- https://access.redhat.com/errata/RHSA-2010:0786
- https://access.redhat.com/errata/RHSA-2010:0770
- https://access.redhat.com/errata/RHSA-2010:0768
- http://www.opera.com/docs/changelogs/unix/1060
- http://www.opera.com/support/search/view/944
Sources
- CVE-2009-3555 · CVE Program
- CVE-2009-3555 · NVD
- FIRST EPSS
- GHSA-f7w7-6pjc-wwm6 · GitHub Advisory Database · CC BY 4.0
- CVE-2009-3555 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences