CVE-2009-4565

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle…

published January 4, 2010

CVSS
—
EPSS
2%
Percentile
83.9
In the wild
Unconfirmed
What it is

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02395 · 83.9th percentile
Published
2010-01-04T21:00Z
EPSS history
Timeline
  • 04 JAN 21:00Z
    sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle…
    cvelistv5